Use SOURCE_DATE_EPOCH for X.509 validity and hash the unsigned
certificate fields to derive stable serial numbers. The hash includes
payload extensions, so changed firmware gets a new serial.
Retain the existing behavior when the variable is unset and reject
invalid values. ECDSA signatures remain nondeterministic.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>