Code sign ZIP update packages

We need to check if the ZIP update files produced by Esky need to be signed, in fact:

• For OSX, the Nuxeo Drive.app bundle is signed before it is packaged as a DMG, and the same signed bundle is used to produce the ZIP update artifact, so it should be fine.
• For Windows, it is the MSI that is signed, whereas the ZIP is not, it should probably be, and it might prevent the "Unknown publisher" to be displayed in the warning or sudo popup when a new version is installed by the updater.