Add a PKCS12 Windows code signing certificate and sign exe/msi artifacts.

[rryan]

This certificate is encrypted with AppVeyor's "secure files" tool:
https://www.appveyor.com/docs/how-to/secure-files/

The secret, salt and password in appveyor.yml are encrypted with
AppVeyor's repository-specific public key. During AppVeyor builds, the
environment variables are set to the decrypted value of the secret,
salt, and password which allows us to decrypt the PKCS12 file and then
decrypt the private key within the PKCS12 file.

The private key in the PKCS12 file itself is encrypted with
PBE-SHA1-3DES, since apparently Windows does not support AES.

TESTED:

• Signs successfully in a private fork:
  https://ci.appveyor.com/project/mixxxdj/mixxx-22dnk/builds/34050805/job/398st49hp35yyfha

[uklotzde]

I guess we just need to merge this PR to see if it actually works?

...
-- Installing: C:/mixxx/./doc/Mixxx-Manual.pdf
IF [%APPVEYOR_PULL_REQUEST_NUMBER%] == [] ( signtool sign /f ..\%CODESIGN_CERTIFICATE_PATH% /p %CODESIGN_CERTIFICATE_PASSWORD% *.exe ) else ( echo "Skipping codesigning *.exe because we are in a pull request." )
"Skipping codesigning *.exe because we are in a pull request." 
cpack -G "WIX"
CPack: Create package using WIX
CPack: Install projects
CPack: - Install project: mixxx []
CPack: Create package
CPack: - package: C:/projects/mixxx/cmake_build/mixxx-pr-2937-appveyor-codesign-d4424e300957d38e058410df6a646f2c274a9aa9.msi generated.
IF [%APPVEYOR_PULL_REQUEST_NUMBER%] == [] ( signtool sign /f ..\%CODESIGN_CERTIFICATE_PATH% /p %CODESIGN_CERTIFICATE_PASSWORD% *.msi ) else ( echo "Skipping codesigning *.msi because we are in a pull request." )
"Skipping codesigning *.msi because we are in a pull request." 
...

[rryan]

I guess we just need to merge this PR to see if it actually works?

Nope -- see the "TESTED" section. :)

signtool sign /f ..\%CODESIGN_CERTIFICATE_PATH% /p "%CODESIGN_CERTIFICATE_PASSWORD%" *.msi
Done Adding Additional Store
Successfully signed: mixxx-appveyor-codesign-a3b4933ac9fd1b3a8dc5ff1748063457ad3b4a32.msi

[rryan]

Though I should note, this isn't a fully working solution for code signing. We still need to sign any DLLs that are bundled (e.g. Qt plugins) and potentially we have to unpack the WiX bundle and sign some of its internals. I'm hoping someone else can look at that while I handle macOS signing on Travis.

[Be-ing]

Whoops, this was merged to master instead of 2.3. I cherry-picked it to 2.3: 07f46bd