WHIP: X509 cert serial number should be positive.

[winlinvip]

According to RFC5280 4.1.2.2, The serial number MUST be a positive integer assigned by the CA to each certificate.

[winlinvip]

Since Go1.23, Go DTLS server may fail the FFmpeg request, for it verify the serial number:

	if serial.Sign() == -1 {
		if x509negativeserial.Value() != "1" {
			return nil, errors.New("x509: negative serial number")

See golang/go@db13584