CI: Move Windows signing to reusable workflow

[derrod]

Description

In order for the job_workflow_sha claim in the JWT to actually correspond to the workflow's last modification commit it has to be a reusable workflow. This is annoying, and somewhat silly given GitHub's documentation indicates otherwise, but what can you do...

Bonus points for there not being a way to get the ref of the currently executed reusable workflow, the only way I (and others) could find was to parse the JWT, which is "easy" here since this job uses it anyway.

Note: this PR needs to be merged via merge commit to avoid the hashes becoming invalid. Alternatively the second commit could be split into its own or directly pushed to master, but I'd like to not do that.

Motivation and Context

Want to pin specific version of signing action/bouf configuration for Google Cloud Authentication.

How Has This Been Tested?

Ran on my fork.

Types of changes

• Tweak (non-breaking change to improve existing functionality)
• Code cleanup (non-breaking change which makes code smaller or more readable)

Checklist:

• My code has been run through clang-format.
• I have read the contributing document.
• My code is not on the master branch.
• The code has been tested.
• All commit messages are properly formatted and commits squashed where appropriate.
• I have included updates to all appropriate documentation.