More webstart code-signing changes (rebased onto develop)



This is the same as gh-2193 but rebased onto develop.

----

Add a [`Trusted-Only`](http://docs.oracle.com/javase/6/docs/technotes/guides/jweb/mixed_code.html#trusted_only) attribute to manifest. I think this helps avoids additional warnings in Insight webstart. When testing locally it didn't affect the running of the standard Insight client, but this should be tested more widely. Also disable automatic self-signing. See commit messages for more info.

Testing: check insight still fully works. Check the unsigned server works. Then we can try signing webstart with the proper certificate and redeploying.

@bpindelski Do you know anything about the impact (good or bad) of `Trusted-Only`?