crypto/x509: return error for missing SerialNumber.

If the SerialNumber is nil in the template then the resulting panic is
rather deep in encoding/asn1 and it's not obvious what went wrong.

This change tests and returns a more helpful error in this case.

Fixes #16603.

Change-Id: Ib30d652555191eb78f705dff8d909e4b5808f9ca
Reviewed-on: https://go-review.googlesource.com/27238


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>