Add validation that apphost/comhost are not signed

[dagood]

Tracking issue for this bit of https://github.com/dotnet/core-setup/issues/5254. Regression causes the output FDD/FDE host to be unsignable: dotnet/core-setup#7549.

Needs tool support: dotnet/arcade#3749.

(This tracks the Windows infra for signing validation.)

[safern]

We also need to do this for singlefilehost which was recently added.

[NikolaMilosavljevic]

Tooling is available - see dotnet/arcade#4058. Please ensure that it is being used.