Evaluate alternatives to @vscode/vsce-sign

[spoenemann]

The ovsx package depends on @vscode/vsce-sign through the usage of @vscode/vsce. The vsce-sign has a problematic license, see https://gitlab.eclipse.org/eclipsefdn/emo-team/iplab/-/issues/25926

We should evaluate whether the vsce-sign package can be replaced, e.g. with https://github.com/filiptronicek/node-ovsx-sign

[netomi]

that could also solve #1493

[netomi]

on top of that the package has postInstall scripts that are mandatory. The sooner we can get rid of this dependency the better imho

In the face of Sha-Hulud and similar attacks, it should be mandatory to not allow any scripts by default.