Avoid deprecation warnings from NSS >= 3.14

Avoid deprecation warnings from NSS >= 3.14

- NSS >= 3.14 introduces support for DSA2 and marks DSA_SUBPRIME_LEN
  as deprecated. Use explicit DSA1_SUBPRIME_LEN (we only support DSA1
  for now) instead where available, add compatibility define for
  older versions.
- Also directly include <blapit.h> where its defined - blabit.h gets
  included via cryptohi.h but being explicit about it avoids having
  to redefine it again "just in case".
(cherry picked from commit 73be0fc7d9faab9f1120e2979f2ca1feed522195)