Related to #14438

This is the second part of #14438. This PR integrates the pkg tool, introduced in #15205, into SignTool. More specifically, this PR enables the unpacking and repacking of .pkgs and nested .app bundles within SignTool & adds tests & test data for this functionality into SignTool.Tests.

This is a rather large change, including quite a lot of refactoring as SignTool is becoming a bit bloated. Highlights

• Removed the use of ITaskItem in the signtool sources, aside from the task. It made no sense to have some data passed around as MSBuild items, and others passed around formalized types. Introduce new types where needed.
• Notarization is supported via a "dual sign" mechanism similar to a dual sign certificate. At some point, we may want to change this model and make notarization a separate concept (a new signing information type). For now, I deemed that approach too invasive. Right now, there are special certs for Mac that represent both notarization and signing. When those certs are used. Signtool will both sign and notarize the file, in separate passes.
• Rework the pkg tooling to use the command line API
• Minimally tweak the build manifest model to support the new signing data. I think this should be removed altogether in Remove signing information from the build manifest models #15415
• Add various tests for new pkg tooling, corner case tests for old bugs.
• If files did not have a matching extension or strong name sign info, they wouldn't get signed even if they had an explicit cert specified. Fix this.

There is more follow on work to be done here. Signtool is due for a major refactor to deal with all the various archive types it now supports. There is far too much "If ".