pki: Don't generate negative random serial numbers in X.509 certificates

According to RFC 5280 4.1.2.2 we MUST force non-negative serial numbers.

src/pki/commands/issue.c

@@ -363,6 +363,7 @@ static int issue()
 			rng->destroy(rng);
 			goto end;
 		}
+		serial.ptr[0] &= 0x7F;
 		rng->destroy(rng);
 	}
 

src/pki/commands/self.c

@@ -314,6 +314,7 @@ static int self()
 			rng->destroy(rng);
 			goto end;
 		}
+		serial.ptr[0] &= 0x7F;
 		rng->destroy(rng);
 	}
 	not_before = time(NULL);