chore(windows): Sign internal exe using beforeBundleCommand (#3994)

Refs #3230 

It looks like we need to sign the internal exe before it gets bundled
too. We can use `beforeBundleCommand` to do so.

Soon, Tauri should have native support for this exact scenario:
https://github.com/tauri-apps/tauri/pull/8718

scripts/build/sign.sh

@@ -1,6 +1,11 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+if ! command -v AzureSignTool &>/dev/null; then
+    echo "AzureSignTool not installed. Signing will be skipped."
+    exit
+fi
+
 AzureSignTool sign \
     --azure-key-vault-url "$AZURE_KEY_VAULT_URI" \
     --azure-key-vault-client-id "$AZURE_CLIENT_ID" \