OCSP: preserved serial number sign in cache keys

OCSP: preserved serial number sign in cache keys

As OpenSSL does not store the sign in the ASN1_INTEGER string data,
it is not possible to distinguish positive and negative serial numbers.
While negative serials are forbidden in RFC 5280 4.1.2.2, it also says
that we SHOULD expect these from non-conforming CAs.
The solution is to use full DER-encoding of a signed integer obtained
with i2d_ASN1_INTEGER.

The change also addresses a correctness issue, as ASN1_STRING accessors
should not be used on ASN1_INTEGER.