SignPath follow-ups: package version, artifact cleanup, signing policy

[Hirogen]

Summary

Follow-ups from the first test-signing run (#730).

• ColumnizerLib package version: the nupkg came out as 1.40.4 while everything else was 1.50.0. src/Directory.Build.props pins <PackageVersion>1.40.4.0</PackageVersion>, which wins over the Version the build passes. ColumnizerLibCreate now also passes PackageVersion. The props file is unchanged, so local builds behave as before.
• Unsigned artifacts: after a successful run, the signing workflow deletes unsigned-app and the unsigned installer artifact. The installer artifact is named after its file, so it was easy to confuse with the signed one. They are kept when a step fails, for debugging. This needs actions: write instead of actions: read.
• Code signing policy: a README section with the attribution line, team roles and privacy statement that SignPath Foundation requires before release signing. The privacy statement is grounded in the code: LogExpert makes no network calls of its own, only SFTP to servers the user opens and links the user clicks.

Test plan

• ./build.ps1 --target ColumnizerLibCreate --configuration Release --skip Test produces LogExpert.ColumnizerLib.1.50.0.nupkg
• After merge: run Code Signing (SignPath) with test-signing. Only signed-packages-test-signing should remain, and the nupkg in it should have the GitVersion number

Still to do later: Add the code signing policy on to the release page. That fits together with moving signing into release.yml.