Binary signing for Windows

[rozyczko]

Original Confluence doc: https://confluence.ess.eu/spaces/DAM/pages/511939562/Windows+signing+DigiCertOne

We use digicert/code-signing-software-trust-action action to sign on GitHub

There are 5 GH secrets required for this action:

KEYLOCKER_HOST
KEYLOCKER_API_KEY
KEYLOCKER_KEYPAIR_ALIAS
KEYLOCKER_CERT_DATA
WINDOWS_CERT_PASSWORD

Those are defined on the organizational level, so already present for each EasyScience project.
For reference, the secrets are available on the Confluence page.

The action usage example:

     - name: Setup SM_CLIENT_CERT_FILE from base64 secret data
         if: runner.os == 'Windows'
         run: |
           echo "${{ secrets.KEYLOCKER_CERT_DATA }}" | base64 --decode > /d/Certificate_pkcs12.p12
         shell: bash

     - name: Setup Software Trust Manager
         if: runner.os == 'Windows'
         uses: digicert/code-signing-software-trust-action@v1
         with:
               simple-signing-mode: true
               # If the below 2 parameters are supplied, then smctl executable is invoked to attempt the signing.
               input: ${{ env.SETUP_EXE_PATH }}
               keypair-alias: ${{ secrets.KEYLOCKER_KEYPAIR_ALIAS }}
         env:
               SM_HOST: ${{ secrets.KEYLOCKER_HOST }}
               SM_API_KEY: ${{ secrets.KEYLOCKER_API_KEY }}
               SM_CLIENT_CERT_FILE: D:\\Certificate_pkcs12.p12
               SM_CLIENT_CERT_PASSWORD: ${{ secrets.WINDOWS_CERT_PASSWORD }}