Code signing

The approved publishers and releases client build admission (ADR 0143) is decided against.

Operation	Auth	Purpose
GET /api/code-signing	Bearer + DPoP	List the code-signing registry.
POST /api/code-signing	Bearer + DPoP	Register an approved publisher or release.
DELETE /api/code-signing/{csId}	Bearer + DPoP	Remove one code-signing entry.