If the last hunk of the file isn't 16-byte aligned, pad before digesting.

When we (or MS) create a data directory section, we pad it to 16-bytes.
This means that when you add that and then hash, you'll have that
0-extension before the data directory (in this case, the cert list) in
the checksum.

If we do -h without embedding the signature in the binary, we still need
to take that into account.

Signed-off-by: Peter Jones <pjones@redhat.com>