rpki-client: if anything changed, choose the freshly-fetched TA

rpki-client: if anything changed, choose the freshly-fetched TA

Instead of just looking at the serial number it's easier to use X509_cmp().
This compares the certs' hashes computed during the extension caching. This
is currently SHA-512 for LibreSSL and SHA-1 for OpenSSL, which is good
enough. After all, the TA certs were signed by a trusted source and if you
choose to use OpenSSL this won't be the worst of your problems.

ok job