Unify how serial prefixes are set

[aarongable]

The CA is configured with a one-byte integer serial prefix, which it splats directly into the first byte of the serial it generates: https://github.com/letsencrypt/boulder/blob/eda6e4cb4a0ec4ebcd90812455abbd335c2289f2/cmd/boulder-ca/main.go#L48-L49 https://github.com/letsencrypt/boulder/blob/eda6e4cb4a0ec4ebcd90812455abbd335c2289f2/ca/ca.go#L328

The ocsp-responder is configured with a list of hexadecimal strings that it expects to see at the beginning of serials, so that it can reject requests for non-real serials quickly: https://github.com/letsencrypt/boulder/blob/eda6e4cb4a0ec4ebcd90812455abbd335c2289f2/cmd/ocsp-responder/main.go#L85

These should either both take ints, or both take hex strings, so that they can be configured from the same source of truth.