openjdk-8: build with SunPKCS11 provider enabled

Currently SunPKCS11 provider is available in jdk 11..22, but not 8.

Add build-time dependenices and configure options to turn on SunPKCS11
provider by default.

openjdk-8.yaml

@@ -1,7 +1,7 @@
 package:
   name: openjdk-8
   version: 8.412.08 # this corresponds to same release as jdk8u412-ga / jdk8u412-b08
-  epoch: 1
+  epoch: 2
   description: "IcedTea distribution of OpenJDK 8"
   copyright:
     - license: GPL-2.0-or-later
@@ -40,6 +40,8 @@ environment:
       - libffi-dev
       - libice-dev
       - libjpeg-turbo-dev
+      - libnspr-dev
+      - libnss-dev
       - libpng-dev
       - libtool
       - libx11-dev
@@ -107,6 +109,7 @@ pipeline:
         --disable-docs \
         --disable-system-pcsc \
         --disable-system-sctp \
+        --enable-nss \
         --with-openjdk-src-zip=/home/build/icedtea-drops/openjdk-git.tar.xz \
         --with-hotspot-src-zip=/home/build/icedtea-drops/hotspot.tar.xz \
         --with-jdk-home=/usr/lib/jvm/java-1.7-openjdk \