Native Cosmos driver: code-signing (ESRP / Authenticode / macOS) approval & implementation

Part of the **Cosmos DB Go SDK v2 (`azcosmos/v2`)** effort. The Go v2 SDK links a native artifact built from the Rust driver; released artifacts must be signed through Microsoft's release/code-signing process (**ESRP**). Self-contained; owners decide how to complete it.

**Scope**
- Get artifacts signed through ESRP per platform:
- **Windows** — Authenticode-sign `azurecosmosdriver.dll`.
- **macOS** — sign `libazurecosmosdriver.dylib`.
- **Linux** — determine what (if any) code signing applies; if none is standard, document that as the expected posture.
- Secure the required ESRP onboarding/approvals for the pipeline.

**Deliverables**
- Signing integrated into the M2 build pipeline for each platform where it applies.
- A documented signing story for Linux (including "no signing is the standard here" if that is the answer).
- Recorded approvals.

**Definition of done**
- Released artifacts are signed per platform via ESRP; the Linux signing posture is documented and accepted.

Start with the M2 build pipeline and ESRP onboarding and approval requirements, then trace how azurecosmosdriver.dll and libazurecosmosdriver.dylib are produced for each platform. Done means ESRP signing is integrated for Windows and macOS, Linux's signing posture is documented and accepted, and approvals are recorded.

Written by the indexing model from the issue text.