Add code signing of release binaries via cargo-code-sign

[zanieb]

Adds code signing of our release binaries on Windows and macOS, using temporary self-signed certificates for testing.

Instead of signing via uv build as explored in #18262, we use a cargo extension to sign on build. This allows us to sign both the artifacts inside and outside of wheels without changing maturin. This builds on patterns introduced in #18276.

I built cargo-code-sign as a standalone tool, heavily referencing existing code signing techniques in the ecosystem, see https://github.com/zanieb/code-sign-tools

Includes #18295
This does not configure secrets for the actual release environment yet.

[woodruffw]

I think there are additional Apple-specific X.509 extensions we need to include here, in order for the self-signed cert to look "right" to Apple's codesigning machinery.

Ref: https://docs.rs/apple-codesign/0.29.0/src/apple_codesign/certificate.rs.html#1276-1286

(Maybe it makes sense to use rcodesign to bootstrap the testing cert here?)

[samypr100]

Note this will also inherit from the host openssl.conf (if it exists) and may alter the output in some cases. Normally when I have done this I tend to pass the entire config via stdin to avoid such cases with scripts invoking openssl e.g.

openssl req -x509 -newkey rsa:2048 -sha256 -days 7 -nodes \
  -keyout "$CERT_DIR/key.pem" \
  -out "$CERT_DIR/cert.pem" \
  -config <(
	cat <<-EOF
    [req]
    prompt = no
    distinguished_name = dn
    x509_extensions = ext

    [dn]
    O = Astral Software Inc.
    CN = $CERT_NAME

    [ext]
    keyUsage = digitalSignature
    extendedKeyUsage = codeSigning
	EOF
  )

[zanieb]

Enumerate these in a bullet point list, we don't need to differentiate between secrets / variables in this doc