Switch to OIDC for signing login.

[zooba]

Also adds the test certificate root CA to work around a signing tool limitation

[zooba]

So the signing tool limitation cannot be worked around, and I believe the signing tool fails during the legacy MSI build because it makes multiple attempts at authentication. The next release of the signing tool will let us set %AZURE_TOKEN_CREDENTIALS%=AzureCliCredential and it should only try one approach, but right now they're using an old library without that support. So we're still using a secret token for legacy builds (which unfortunately means it's still just as vulnerable, but at least we aren't accessing it in most other builds now).

[zooba]

Looks like the final test build passed as well, so this is probably the final form of this PR.