Transition from Digicert keylocker to Azure Trusted Signing

Our digicert keylocker certificates have a limited number of signatures available (598 as of this issue).

We'll need to ensure continuity in signing windows releases (nightly/canary/full releases).

Azure trusted signing is a more cost effective mechanism for signing code going forward.

The OpenJS foundation has established a Trusted Signing account as per: https://learn.microsoft.com/en-us/azure/trusted-signing/quickstart?tabs=registerrp-portal%2Caccount-portal%2Corgvalidation%2Ccertificateprofile-portal%2Cdeleteresources-portal to allow OpenJS projects to use our Identity to sign windows binaries.

The rough estimate is that we have a couple of months worth of signatures before we run out, (worst case 75 days).

So the next steps to get this addressed:

• Set up a nodejs signing account in azure that uses the trusted signing account, and has access to the appropriate secrets that we can inject into our release pipeline
• Set up the release machines/install trusted signing
• Modify the release pipelines to sign the code with the new mechanism

Review the Azure Trusted Signing account, release machines, and release-pipeline changes described in the issue. Verify that signing remains continuous for nightly, canary, and full Windows releases and that the new mechanism replaces the limited Digicert KeyLocker signatures.