security/dogtag-pki: Update to 11.10.1

Switch to Java 21.

Adapt the FreeBSD parts to the reworked upstream tree: guard the SELinux
import and its call sites, replace the remaining runuser call with
subprocess privilege switching, and pass APP_SERVER_CM through the
environment, which 11.10 reads instead of the CMake define.

Give pki-tomcatd a bounded stop. jsvc records the pid of its child in
the pidfile while the parent handles SIGTERM, and Tomcat can deadlock in
JSS while closing LDAP connections, so rc(8) would wait forever and
stall the system shutdown.

Changes: https://github.com/dogtagpki/pki/releases

Sponsored by: Netzkommune GmbH