add signingscript integration tests

Ideally, we would be able to catch things like incompatible osslsigncode bustage in signingscript, before we roll out.

Integration tests may look like:

• we run a test in docker-worker, after spinning up a mock Autograph instance; or
• we run a test in a docker-worker instance that lives in a staging-Autograph-enabled subnet; we put non-sensitive secrets somewhere in TC secrets, and sign a bogus file with self-signed certs; or
• something else. I'd like to avoid something overengineered.

As long as we're exercising the signing flow, this should catch this type of bustage; we can add coverage as we find additional paths that need it later.

No se nombran archivos ni pruebas existentes. Empieza por localizar el flujo de firma de signingscript y sus puntos de integración con docker-worker, y después compara los enfoques propuestos de un Autograph simulado y una staging-subnet. Se considera terminado cuando una prueba de integración ejecuta la firma de un archivo ficticio con certificados autofirmados y puede detectar cambios incompatibles en osslsigncode.