libcacard: Lock NSS cert db when selecting an applet on an emulated card