Code-sign air binaries on Windows

[jmcphers]

Signs air.exe on Windows.

I'm not too familiar with Air's release flow, so I haven't trialed this (don't want to accidentally trigger unwanted uploads or releases).

Since air.exe is built with cargo-dist, it's necessary to pull the executable out of the artifact, sign it, and put it back.

Part of posit-dev/positron#9962.

[DavisVaughan]

release.yml is auto generated by cargo dist, so we cannot accept this as is.

I'll investigate other ways to hook into the cargo dist release system to try and do this.