Repository: tauri
Issue: [feat] Reduce code signing sessions during bundling process
Labels: type: feature request

### Describe the problem

After configuring an application to sign with a new OV code signing certificate on a YubiKey 5 FIPS device, the build process prompts for the code signing PIN seven times. This occurs because `signtool.exe` is used to sign code, which triggers a prompt each time it is called. When there are multiple applications to sign, the bundler calls `signtool.exe` multiple times.

### Describe the solution you'd like

The dream solution would be to leverage a pkcs11 interface library like [`cryptoki`](https://github.com/parallaxsecond/rust-cryptoki) or [`native-pkcs11`](https://github.com/google/native-pkcs11) to open a code signing session and persist that session while signing everything that needs to be signed, build the installers, and sign the installers before closing the session. Then the PIN could be supplied as an environment variable or entered a single time at a prompt in the terminal, avoiding the dialog on Windows entirely. This would also be cross-platform compatible because the pkcs11 libraries are cross-platform.

My suggestion would be to add `pkcs11` to the list of keys in [`WindowsConfig`](https://tauri.app/v1/api/config#windowsconfig) and use that to indicate the path of the pkcs11 device. If present, that could trigger the use of pkcs11 code signing. If absent, the existing flow with `signtool.exe` could remain, but hopefully with a reduced number of calls to sign multiple files the minimum number of times possible, reducing the number of PIN prompts as much as possible.

### Alternatives considered

- Sign multiple files with each call to `signtool.exe`. This would reduce the number of prompts to two, I assume. First for anything that needs to be signed before going into an installer, then once again for the installers.
- Custom signing script. This was proposed by @amrbashir in a [comment](https://github.com/tauri-apps/tauri/pull/8718#pullrequestreview-1870698873) on an open pull request that would add AzureSignTool support. Custom script support will open the door for unique project needs, but the common workflow should not depend on a custom signing script. As old OV code signing certificates expire, more people will be renewing to certificates stored on HSM devices that support pkcs11, but `signtool.exe` will always prompt each time it is called on Windows. 
- Switch the main workflow from `signtool.exe` to a tool that can support automated code signing. [`osslsigncode`](https://github.com/mtrojnar/osslsigncode) looks like a viable alternative as a tool, but it doesn't have a Windows installer. Maybe it could be automatically downloaded by the Tauri bundler, along with its dependencies, the way WIX is downloaded.

### Additional context

Windows code signing currently depends on `signtool.exe`, which is not guaranteed to be present in any environment, certainly not on Linux. Switching to a `pkcs11` library has the potential of opening up Windows application bundling on any platform supported by the install system, which could simplify the build pipeline for some cross-platform applications. 

I'm willing to work this up into a pull request, depending on what direction the Tauri developers would want it to go.