(#7244) Consolidate autosign setting

Previous implementation split out a new autosign_command setting for the
custom policy executable, which required a confusing autosign=false
setting.

This commit removes the autosign_command setting and instead uses the
autosign setting for all modes (true/false, autosign.conf or custom policy
executable).  Internally we refactor to distinguish between autosign.conf
or an executable by the executable bit.

We are removing the mode of the autosign setting, because it was stripping
all executables of their executable bit.  This only removes the guarantee
that group and other do not have write permissions. However, these are the
default permissions for a regular file on most systems, so nothing should
be lost.