Fix the credentials sorting algorithm to correctly sort X509SecurityKey instances

src/OpenIddict.Client/OpenIddictClientConfiguration.cs

@@ -246,7 +246,7 @@ public sealed class OpenIddictClientConfiguration : IPostConfigureOptions<OpenId
 
             // If one of the keys is backed by a X.509 certificate, don't prefer it if it's not valid yet.
             (X509SecurityKey first, SecurityKey)  when first.Certificate.NotBefore  > DateTime.Now => 1,
-            (SecurityKey, X509SecurityKey second) when second.Certificate.NotBefore > DateTime.Now => 1,
+            (SecurityKey, X509SecurityKey second) when second.Certificate.NotBefore > DateTime.Now => -1,
 
             // If the two keys are backed by a X.509 certificate, prefer the one with the furthest expiration date.
             (X509SecurityKey first, X509SecurityKey second) => -first.Certificate.NotAfter.CompareTo(second.Certificate.NotAfter),

src/OpenIddict.Server/OpenIddictServerConfiguration.cs

@@ -319,7 +319,7 @@ public sealed class OpenIddictServerConfiguration : IPostConfigureOptions<OpenId
 
             // If one of the keys is backed by a X.509 certificate, don't prefer it if it's not valid yet.
             (X509SecurityKey first, SecurityKey)  when first.Certificate.NotBefore  > DateTime.Now => 1,
-            (SecurityKey, X509SecurityKey second) when second.Certificate.NotBefore > DateTime.Now => 1,
+            (SecurityKey, X509SecurityKey second) when second.Certificate.NotBefore > DateTime.Now => -1,
 
             // If the two keys are backed by a X.509 certificate, prefer the one with the furthest expiration date.
             (X509SecurityKey first, X509SecurityKey second) => -first.Certificate.NotAfter.CompareTo(second.Certificate.NotAfter),

src/OpenIddict.Validation/OpenIddictValidationConfiguration.cs

@@ -159,7 +159,7 @@ public sealed class OpenIddictValidationConfiguration : IPostConfigureOptions<Op
 
             // If one of the keys is backed by a X.509 certificate, don't prefer it if it's not valid yet.
             (X509SecurityKey first, SecurityKey)  when first.Certificate.NotBefore  > DateTime.Now => 1,
-            (SecurityKey, X509SecurityKey second) when second.Certificate.NotBefore > DateTime.Now => 1,
+            (SecurityKey, X509SecurityKey second) when second.Certificate.NotBefore > DateTime.Now => -1,
 
             // If the two keys are backed by a X.509 certificate, prefer the one with the furthest expiration date.
             (X509SecurityKey first, X509SecurityKey second) => -first.Certificate.NotAfter.CompareTo(second.Certificate.NotAfter),