Sign on Linux instead of Windows

[virzak]

Moves the sign job from windows-latest to ubuntu-latest.

The Windows runner was there for one reason: dotnet sign supports Trusted Signing but
cannot run anywhere else - its backend, Microsoft.Trusted.Signing.Client, ships a native
signtool Dlib with MFC/MSVC dependencies. dotnet nuget sign runs anywhere but only with a
local private key, which a key in Trusted Signing does not have.

sign-universal closes that gap: NuGet's own
signing pipeline with the private-key operation redirected to Trusted Signing over HTTPS.

Nothing else changes. The job keeps its name, inputs and outputs, publish still
consumes packages-signed, and the signatures are ordinary NuGet author signatures - a
package signed either way is indistinguishable to consumers. The node install and the
nektos/act path shim go away with Windows.

Verified before proposing

The exact command in this job, run against Zomp.SyncMethodGenerator 2.0.38 on Linux with
the real credentials:

Signed Zomp.SyncMethodGenerator.2.0.38.nupkg
  signature: author, SHA256
  timestamp: http://timestamp.digicert.com/

dotnet nuget verify --all -> exit 0
  Signature type: Author
  Subject Name: CN=Zomp Inc., O=Zomp Inc., L=Toronto, S=Ontario, C=CA

Two things worth knowing

--trust-signing-root is required on Linux and its absence is not obvious. Trusted
Signing issues from Microsoft Identity Verification Root CA 2020, which Linux trust
stores do not carry, and NuGet validates the signing certificate's chain before it will
sign. Without the flag the step fails with only Certificate chain validation failed. The
root is installed for that user alone, taken from the chain the signing service itself
returned.

The tool version is pinned. The thing signing a release should not change unless
someone chooses to change it.

What this PR cannot prove

The Sign and Verify signature steps are gated on github.ref == 'refs/heads/master',
so they do not run here - CI will only show that the job's structure is sound and the tool
installs. Signing itself first executes on the next push to master. It fails loudly rather
than silently if anything is wrong: the verify step gates the artifact while it can still
be thrown away.

Rolling back is reverting this commit.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.82%. Comparing base (9205073) to head (f2d048c).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #151   +/-   ##
=======================================
  Coverage   93.82%   93.82%           
=======================================
  Files           9        9           
  Lines        1522     1522           
  Branches      352      352           
=======================================
  Hits         1428     1428           
  Misses         25       25           
  Partials       69       69           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.