Implement support for PCK signing.

[bruvzg]

• Adds support for PCK signing. Works in a similar manner to the PCK encryption:
  • SHA256 file hashes added to the PCK directory structure.
  • "require validation" file flags added to the PCK directory structure (hashes of the files w/o flag are not validated to save loading time).
  • PCK directory is signed using provided keypair.
  • If enabled (executable compiled with the public key), it will refuse to load unsigned PCKs.
• Adds buttons to generate keys from the exporter UI.
• Improve PCK encryption and signing filters handling to automatically include imported files and remaps.

As with encryption, custom build is required to enable validation (using environment variables a build time):

[akien-mga]

Looks like a pretty thorough implementation. I have yet to test it to see how the flow is like. This will require extensive user documentation so they know how to use it (we're currently also lacking in documentation for the script signing, we have a page about compiling custom templates but no real mention of it in the Exporting section of the docs).

I'd like @Faless to review the crypto related changes.

And overall this requires some discussion with maintainers and users to see how desirable this feature would be. It adds a bit of complexity, so we need to make sure it's something users would actually use.

There's significant demand for better obfuscation / protection of PCKs, so this seems to go in the right direction for this use case, but we need to make sure those users would be happy with this solution.

[reduz]

This looks extremely good. In fact, I am not sure if we should also just deprecate the old encryption menu and keep signing with private key only.

[bruvzg]

I am not sure if we should also just deprecate the old encryption menu and keep signing with private key only.

I'm not sure if I see how it's related: encryption is used to hide information and signing to prevent modification, it's different stuff for different purpose. ECDSA is not suitable for encryption (and ECIES is not supported by mbedtls), and using the same key as both public key and encryption key is usually considered unsafe.