Add test for subordinate CA clone with HSM

A new test has been added to install a subordinate CA with HSM,
clone the HSM, then create a clone of the subordinate CA with
the cloned HSM.

There is a known issue: the OCSP signing cert and subsystem
cert are missing from the internal token on the clone, but it
does not actually cause a problem since the certs do exist on
the HSM.

.github/workflows/ca-tests2.yml

@@ -119,6 +119,13 @@ jobs:
     with:
       db-image: ${{ needs.init.outputs.db-image }}
 
+  subca-clone-heml-test:
+    name: Sub-CA clone with HSM
+    needs: [init, build]
+    uses: ./.github/workflows/subca-clone-hsm-test.yml
+    with:
+      db-image: ${{ needs.init.outputs.db-image }}
+
   scep-test:
     name: SCEP responder
     needs: [init, build]