add signingscript integration tests

[escapewindow]

Ideally, we would be able to catch things like incompatible osslsigncode bustage in signingscript, before we roll out.

Integration tests may look like:

• we run a test in docker-worker, after spinning up a mock Autograph instance; or
• we run a test in a docker-worker instance that lives in a staging-Autograph-enabled subnet; we put non-sensitive secrets somewhere in TC secrets, and sign a bogus file with self-signed certs; or
• something else. I'd like to avoid something overengineered.

As long as we're exercising the signing flow, this should catch this type of bustage; we can add coverage as we find additional paths that need it later.