Unable to skip already signed files (for instance for publishing a website zip)

It would be useful when signing e.g. a zip file created by publishing a website, to only sign unsigned files. This way existing signatures on DLLs such as those distributed by Microsoft don't get overwritten, and there would be less overhead when using KeyVault HSM.

This might be indirectly related to #547 where the default action was changed to overwrite, and the fact that the documented `force` flag doesn't seem to exist. The options to skip, overwrite, or append a signature would seem to be appropriate instead of force.

If you select to skip existing signatures, it should (optionally?) check the existing signature is valid, then skip the file if it is. If it is not, then it should 'fall through' to overwrite. In the case where append is used, it should also check the existing signature.

At the moment, the only way of implementing this that I can see, is to pre-scan the files and generate a filelist, although it is not entirely clear how this would work with files inside nuget or zip files as the documentation around the --file-list command is a little unclear.

Version: 0.9.1-beta.23530.1+f4efed9e8fb3296f29497b90feb6548e506f2078

Start by reading the documented --file-list behavior and tracing how signing handles files inside NuGet or ZIP archives. Define the skip, overwrite, and append options, including validation of existing signatures and fallback behavior, then verify that publishing a website ZIP preserves valid DLL signatures and avoids unnecessary KeyVault HSM operations.

Written by the indexing model from the issue text.