Sign latest and first files when sign_update is defined

[gtkramer]

When using the --no-signing option on mixer, mixer will not sign the latest file. This is not being done today by our process and is required for supporting future enhancements to swupd. The first file is not used by mixer or swupd, but supports creating delta packs from the first build in every format, and also supports MCA. This file should also be signed.

[gtkramer]

This finishes the last bit of implementing custom signing

[gtkramer]

I'm not sure if the first file needs signed? It's a DevOps-only artifacts that is useful for us to keep track of producing delta packs from the first build in the format to the current as an optimization for swupd clients. It's neither produced by mixer nor consumed by swupd, but is helpful for MCA according to @jwakre

[mbelluzzo]

We do have an equivalent file now under update that is used by swupd and signed by mixer already. So nowadays it is possible to stop using the root latest file in favour of the update/ one.