Makefile: allow passing a Windows signing cert file
Makefile: allow passing a Windows signing cert file

Currently, we build Windows objects on a dedicated VM which already has
the certificate imported.  When we build on GitHub Actions, we'll need
to build binaries using a certificate and password specified on the
command line.  To do so, add several environment variables that allow
specifying these values, and if they're specified, pass appropriate
arguments on the command line.  Note that we hide the output from these
commands so as not to leak secrets into the log.

Additionally, add a target to the Makefile which can be used to write a
Base64-encoded certificate to a file on the file system without echoing
it so we don't leak even the encrypted certificate to the log.

github/git-lfs,github/git-lfs,github/git-lfs