Add Azure Artifact Signing release flow

[barfle]

Summary

• add Azure Artifact Signing to the Windows release workflow
• sign dataplicity.exe before MSI packaging, then sign the final MSI before checksum generation
• bump the next signed release candidate to 0.1.7

Azure setup completed

• registered Microsoft.CodeSigning
• created Artifact Signing account dataplicity-cli-signing in rg-dataplicity-code-signing
• configured GitHub OIDC app github-dataplicity-cli-signing
• assigned Artifact Signing Certificate Profile Signer on the signing account
• configured GitHub repo variables/secrets for signing

Remaining Azure portal step

• complete Artifact Signing organization identity validation
• create certificate profile dataplicity-cli-public using that validation

Test plan

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); puts "release workflow YAML OK"'
• /tmp/dataplicity-cli-test-venv/bin/pip install -e '.[test]' >/dev/null && /tmp/dataplicity-cli-test-venv/bin/pytest -q