Preserve all signed PE files when stripping releases

[mrmathematica]

llvm-strip removes Authenticode certificate data from PE files without clearing the IMAGE_DIRECTORY_ENTRY_SECURITY entry. The resulting certificate table points beyond EOF, producing a malformed binary that signtool rejects with 0x800700C1 ("%1 is not a valid Win32 application").

Previous fixes in #856 and #1217 avoided this for known DLL filenames. However, the list is incomplete: signed zlib1.dll files can exhibit the same corruption, and future dependency changes could introduce more affected filenames.

Replace the signed-DLL filename list with PE header inspection. Skip llvm-strip whenever the input has a non-empty certificate table whose file-offset range is within the file. Continue preserving Tcl 9 DLLs separately because their embedded ZIPFS data must not be stripped.

Add tests covering:

• signed PE32 and PE32+ files with in-bounds certificate tables;
• unsigned and malformed files, which remain eligible for stripping;
• Tcl 9 DLLs containing ZIPFS data.

This is a durable follow-up to issue #855 and PRs #856 and #1217, without requiring every signed DLL to be identified in advance.

[jjhelmus]

Thanks for putting this together. I'm out this week but will give this a review when I am back.