Delay NSS initialization until actually used

Delay NSS initialization until actually used
- since NSS is allergic (ie becomes non-functional) after forking, delay
  it's initialization until really needed, ie lazy init in rpmDigestInit()
- however as NSS init can fail if attempted in completely empty chroot,
  we force crypto init to happen at transaction set create time, forking
  past that is pretty much doomed anyway
- this is the other half of the fix for rhbz#476737, and similar case
  noticed by Pixel in Mandriva (due to urpm forking)