More webstart codesigning tweaks

Add a [`Trusted-Only`](http://docs.oracle.com/javase/6/docs/technotes/guides/jweb/mixed_code.html#trusted_only) attribute to manifest. I think this helps avoids additional warnings in Insight webstart. When testing locally it didn't affect the running of the standard Insight client, but this should be tested more widely. Also disable automatic self-signing.

See commit messages for more info.