[infra] signed binaries

[prabhu]

cdxgen is distributed in unsigned binary form (!) via winget and other distribution mechanisms. OWASP currently lacks a process to procure and maintain signing keys, so we need to do this with an individual email or via a company like AppThreat.