Add test for #823 (fixed in #824) for negative cert serial nums.
Properly raise when a file cannot be created exclusively.

Our logic did not atomically ensure a file would be created
exclusively. It did a pre-create check to see if the file existed
and would raise an error if exclusive creation was requested. If
the file did not exist, it proceeded to do the proper atomic
create call but ignore the return value. Another thread (or
process) could jump in between these two operations and create the
file. Our logic would then proceed to open a file it intended to
have created exclusively but which was actually created by another
thread or process.

The fix is simple: raise if an exclusive create fails and
exclusive creation was requested.

Fixes #827, and a rubyspec is in rubyspec/rubyspec#231.