Add thumbprints for digital signatures in package manifests

Description of the new feature/enhancement

Installers from some vendors don't have version specific download links and instead have a generic 'whatever latest version' download link.

winget manifests should have extra fields for validating the digital signature of the binary with the WinVerifyTrust function instead of the binary hash.

For example:

Installers:
  - Arch: x64
    Url: https://dl.google.com/edgedl/chrome/install/ChromeStandaloneSetup64.exe
    Thumbprint: cb7e84887f3c6015fe7edfb4f8f36df7dc10590e
    CommonName: Google LLC

This would enable support for downloading and installing binaries when they're using generic 'whatever latest' urls while also enforcing signature validation of the binary.

Proposed technical implementation details

The "Thumbprint" and/or "CommonName" fields would be entirely optional but when they're present the digital signature is validated instead of the binary hash.

Start by locating the package manifest installer schema and the code that validates installer binaries. Review the WinVerifyTrust documentation and determine how optional Thumbprint and CommonName fields should interact with the existing hash validation. Done means manifests can express these fields and generic URLs are accepted only when the specified signature validation succeeds.