PICARD-3002: Use Azure Trusted Signing for code signing

[phw]

Summary

• This is a…
  • Bug fix
  • Feature addition
  • Refactoring
  • Minor / simple change (like a typo)
  • Other
• Describe this change in 1-2 sentences:

Problem

• JIRA ticket (optional): PICARD-3002

The code signing certificate for the Windows builds had expired and needed to be replaced. This also involved changing the certificate authority and modernizing the signing procedure.

Solution

Code signing has been set up using Azure Trusted Signing. This has several advantages:

• The certificate gets automatically renewed and rotated frequently
• No need to handle the certificate file during the CI process
• Integration into Github Actions is easily possible using azure/trusted-signing-action
• Much cheaper than purchasing the certificate elsewhere
• Certificate is guaranteed to be accepted by Windows

This updates the build process to use azure/trusted-signing-action. As a lot of the Windows build code was dealing with certificate handling and code signing this also simplifies the code.

I have also updated the documentation at https://github.com/phw/picard-code-signing (access is restricted, but @zas has access).

The necessary client secrets AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET, AZURE_ENDPOINT, AZURE_CODE_SIGNING_NAME and AZURE_CERT_PROFILE_NAME are all configured.

Actions

Once this has been merged and backported to 2.x the secrets CODESIGN_P12_URL and CODESIGN_P12_PASSWORD can be removed from the repo, together with the P12 certificate file on the storage.

Update: Already done, code signing wasn't functional anyway and without the variables it isn't performed.

[zas]

LGTM