Verify externally (catalog) signed binaries

[woodruffw]

We currently use WinVerifyTrust to validate in-binary Authenticode signatures, but this doesn't work for externally signed binaries (i.e., those that come with a separate .cat file). Many core WIndows binaries are signed externally, so we should support this case.

Some initial research:

• https://stackoverflow.com/questions/7241453/read-and-validate-certificate-from-executable