Return unknown for un-issued certificates.

CA/B Forum guideline v1.1.9 (since v1.0.3) demands that an OCSP responder should not return GOOD to a request about an unrecognized serial. This patch implements that by logging the unknown serial and returning UNKNOWN to the client. The serials are provided by a file that is specified in the CA configuration. A timeout option is supplied to reload the file each 'timeout' seconds. The serials file must be plaintext with each serial in hex (w/o "0x") and delimited by "\n".