Fix segfault in X509.set_serial_number for negative serials (#1534)

* Fix segfault in X509.set_serial_number for negative serials

hex(serial) renders negative values as "-0x...", so slicing off the
first two characters left a stray "x" and BN_hex2bn failed to parse it.
The failure went undetected because the guard compared BN_hex2bn's int
return value against _ffi.NULL, which is always unequal, so the NULL
BIGNUM was passed straight to BN_to_ASN1_INTEGER and dereferenced.

Format the hex digits directly, which BN_hex2bn accepts with a leading
"-", and check its return value against 0 as documented.
X509.get_serial_number already round-trips negative values.

Co-authored-by: Claude <noreply@anthropic.com>

* Reject negative serial numbers instead of accepting them

RFC 5280 section 4.1.2.2 requires the serial number to be a positive
integer, so set_serial_number now raises ValueError rather than encoding
a value the standard does not permit.

Moves the changelog entry to the backward-incompatible section: a
negative serial previously crashed the interpreter, and callers relying
on that value being stored will now see an exception.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011M5uTyCU4WcNTsPvGrErDo

---------

Co-authored-by: Dylan Pulver <dylanpulver@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>