Sign the VSIX in CI

[Jorriss]

Problem

The released VSIX is unsigned:

• source/StatisticsParser.Vsix/StatisticsParser.Vsix.csproj contains no <SignAssembly> / <AssemblyOriginatorKeyFile>.
• appveyor.yml has no signtool step.
• The VSIX manifest's Publisher="Brent Ozar Unlimited" is unverified — SSMS 22 installs the extension as "Unknown Publisher" and Windows SmartScreen flags the download.

Impact

Social-engineering / impersonation risk: end users can't distinguish a real release from a swapped one downloaded from a malicious mirror.

Remediation

1. Obtain a code-signing certificate (Authenticode, SHA256, with a trusted timestamp authority).

2. Store the PFX and password as AppVeyor encrypted variables (CERT_PFX, CERT_PWD).

3. Add a signing step to appveyor.yml after msbuild and before artifacts: publish:

   signtool sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /f $env:CERT_PFX /p $env:CERT_PWD source\StatisticsParser.Vsix\bin\x64\Release\StatisticsParser.vsix

4. Gate signing on APPVEYOR_PULL_REQUEST_NUMBER being empty so forked-PR builds don't attempt to access the secret (covers finding B6).

[ErikEJ]

@Jorriss I use Azure Artifact Signing, example here: https://github.com/ErikEJ/SqlProjectPowerTools/blob/main/.github/workflows/vsix.yml#L67