Feature Request: Add signature checks to build.ps1

Due to the environment of increased security requirements and recent incidents in npm world,
it would be advisable to add check the signatures of _nuget.exe_ and nuget _Cake_ (or _Cake.exe_) to _build.ps1_.

The signature of _nuget.exe_ can be checked using the powershell command [Get-AuthenticodeSignature](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-authenticodesignature?view=powershell-6)
and nuget package _Cake_ using [nuget verify](https://github.com/NuGet/Home/wiki/NuGet-Verify-Command).

Full example of _build.ps1_ is on my gist .

Example snippet for check _nuget.exe_:
```powershell
# Try download NuGet.exe if not exists
if (!(Test-Path $NUGET_EXE)) {
Write-Verbose -Message "Downloading NuGet.exe..."
try {
$wc = GetProxyEnabledWebClient
$wc.DownloadFile($NUGET_URL, $NUGET_EXE)
} catch {
Throw "Could not download NuGet.exe."
}

$nugetSignature = Get-AuthenticodeSignature -FilePath $NUGET_EXE
if ($nugetSignature.Status -ne "Valid") {
Throw "Signature validation failed for NuGet.exe."
}
}

```

Example snippet for check _nuget.exe_ with explicit signature thumbprint:
```powershell
$NUGET_EXE_SIGN_THUMBPRINTS = @("9DC17888B5CFAD98B3CB35C1994E96227F061675", "...another thumbprint...")

# Try download NuGet.exe if not exists
if (!(Test-Path $NUGET_EXE)) {
Write-Verbose -Message "Downloading NuGet.exe..."
try {
$wc = GetProxyEnabledWebClient
$wc.DownloadFile($NUGET_URL, $NUGET_EXE)
} catch {
Throw "Could not download NuGet.exe."
}

$nugetSignature = Get-AuthenticodeSignature -FilePath $NUGET_EXE
if ($nugetSignature.Status -ne "Valid" && $NUGET_EXE_SIGN_THUMBPRINTS.Contains($nugetSignature.SignerCertificate.Thumbprint)) {
Throw "Signature validation failed for NuGet.exe."
}
}

```

Example snippet for check _Cake_ nuget:
```powershell
Write-Verbose -Message "Restoring tools from NuGet..."
$NuGetOutput = Invoke-Expression "&`"$NUGET_EXE`" install -ExcludeVersion -OutputDirectory `"$TOOLS_DIR`""

if ($LASTEXITCODE -ne 0) {
Throw "An error occurred while restoring NuGet tools."
}
else
{
$md5Hash | Out-File $PACKAGES_CONFIG_MD5 -Encoding "ASCII"
}
Write-Verbose -Message ($NuGetOutput | out-string)

$cakePackage = Join-Path $TOOLS_DIR "Cake/Cake.nupkg"
$NuGetOutput = Invoke-Expression "&`"$NUGET_EXE`" verify Signatures `"$cakePackage`""
if ($LASTEXITCODE -ne 0) {
Throw "Cake nuget is not signed."
}
Write-Verbose -Message ($NuGetOutput | out-string)
```

Start by reading build.ps1, then compare its NuGet and Cake download or restore steps with the Get-AuthenticodeSignature and nuget verify commands linked in the issue. Done means the bootstrap script rejects an invalid NuGet.exe signature and an unsigned Cake package while retaining the existing failure handling; no test file is named in the report.

Written by the indexing model from the issue text.