ci(app): Azure trusted signing for Windows

[y3rsh]

Overview

Replace DigiCert with Azure Trusted Signing.
Helpful Blog
Helpful GitHub Issue
Electron Builder Docs

• Added the 3 secrets
• AZURE_TENANT_ID: ${{secrets.AZURE_TENANT_ID}}
• AZURE_CLIENT_ID: ${{secrets.AZURE_CLIENT_ID}}
• AZURE_CLIENT_SECRET: ${{secrets.AZURE_CLIENT_SECRET}}

After ~ July 12 we can delete all the now unused secrets for DigiCert once everything expires. Don't do it until then just in case.

Test Plan and Hands on Testing

• Trigger a build that will get signed and verify it is signed correctly and installs.
  • https://github.com/Opentrons/opentrons/actions/runs/15327948862/job/43127180352
  • Installer worked and the App certificate is legit and as expected.
  • Analysis worked in the App

Review requests

Things all mapped correctly?

Risk assessment

• Yes, using beta Electron builder feature and new vendor for the process.

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 5 lines in your changes missing coverage. Please review.

Project coverage is 26.47%. Comparing base (df970fe) to head (aa37d79).
Report is 7 commits behind head on edge.

Files with missing lines	Patch %	Lines
app-shell/electron-builder.config.js	0.00%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             edge   #18450      +/-   ##
==========================================
+ Coverage   25.16%   26.47%   +1.31%     
==========================================
  Files        3254     3254              
  Lines      277294   277336      +42     
  Branches    32247    32247              
==========================================
+ Hits        69772    73434    +3662     
+ Misses     207499   203873    -3626     
- Partials       23       29       +6     

Flag	Coverage Δ
app	3.06% <0.00%> (+2.06%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
app-shell/electron-builder.config.js	0.00% <0.00%> (ø)

... and 79 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sfoster1]

Looks great if it works! Make a branch that ends with -app-build-both-as-release to build and sign both internal and release variants

[mjhuff]

🎉