Webstart code-signing 4.4

Minimal changes from dev_5_0 rebased to dev_4_4 so we can code-sign webstart on the server.

* a68a5b4f65d51949633d5787a339dfcd8fa3aebe cherry-picked from #2069
* #2088 is not required
* #2193 rebased
* #2241 rebased

As with gretzky the howe deployment job runs directly from `dist` so will need
`docs/hudson/omero_insight_sign.py lib/keystore omedev dist -kp omedev -cp omedev -ts no`
added to the jenkins shell block.

Testing: as before. Check webstart and standalone Insight clients work. If you want to be particularly thorough check the server.zip artifact contains the correctly signed webstart.