Fix test signing in Windows release pipeline

Currently test signing isn't supported because you need to have installed the (normally untrusted) root onto the build machine first. This is because the signing tools won't submit files for signing unless the certificate is trusted locally (see https://github.com/dotnet/sign/issues/908).

The root certificate needed is at http://www.microsoft.com/pkiops/certs/Microsoft%20Identity%20Verification%20TEST%20ONLY%20Root%20Certificate%20Authority%202020.crt

Should be a simple PowerShell command to install it into the trusted root CAs, but I'll figure out the exact command later.

(Same task as https://github.com/python/pymanager/issues/179)