Codesign all binaries included in GitHub releases during gated release jobs

[BMurri]

Problem:
Right now we don't codesign any binary.

Solution:
It is a corporate policy that all binaries that "can be signed" are signed.

Describe alternatives you've considered
Not including any binaries in GitHub releases, or only including Linux binaries.

Code dependencies
Will this require code changes in:

• CoA, for new and/or existing deployments? No
• TES standalone, for new and/or existing deployments? No
• Terra, for new and/or existing deployments? No
• Build pipeline? No/Yes
• Integration tests? No

Additional context
Gated release jobs exist to add released server images into MCR. Since we are no longer going to release images into MCR, we should instead codesign the binaries we release in those gated release jobs.

This replaces microsoft/CromwellOnAzure#478