Run the code-signing from the target dir

Fix a build problem introduced in #2193. Enter `target/` before running the code-signing script, so that temporary and log files will be removed by `./build.py clean`. Also disable webstart signing in the `update-version` target.

Testing: check webstart works, check gretzky webstart is self-signed, check RELEASE builds aren't signed. Also look out for any instances of unwanted signing if you want, I've got a verification summary script at https://github.com/manics/certificate-generation/blob/master/omero/verify_jars.py