Updating documentation, buildfiles and security hardning

[droren]

This PR updates smimesign to better support real-world X.509 signing workflows on Windows and Linux, improves certificate inspection

tooling, and hardens a few runtime behaviors that matter in production.

What Changed

• Reworked README.md to match the current implementation instead of the older generic project description.
• Added a new cross-platform helper at cmd/git-x509-cert/main.go to extract and display the X.509 certificate embedded in a signed Git
  commit.
• Added make build-tools in Makefile to build that helper.
• Improved signing identity selection in command_sign.go:
  • when multiple certs match the same Git identity, prefer the most signing-oriented cert
  • if ambiguity remains, guide users toward SMIMESIGN_CERT_ID as the stable override
• Added tests for the new identity-selection behavior in command_sign_test.go.
• Added signer-certificate extraction support in ietf-cms/signed_data.go and coverage in ietf-cms/sign_test.go.
• Hardened timestamp fetching in ietf-cms/timestamp/timestamp.go:
  • close HTTP response bodies
  • apply a default timeout
  • bound response size to avoid unbounded reads
• Reduced unnecessary certificate-store exposure in main.go by opening identities only for commands that actually need them.
• Improved cross-build failure behavior in Makefile so Windows and Darwin builds fail early with clear toolchain-prerequisite messages
  instead of opaque cgo compiler errors.

User-Facing Outcome

• Windows users with multiple matching certs should no longer hit the most common “multiple identities match” failure when one cert is
  clearly for signing and another is for auth.
• Linux PKCS#11 and Windows X.509 workflows are now documented in a practical, deployable way.
• Git commit signing certs can now be inspected directly from a repository using the new helper tool.
• Verification and timestamp behavior are safer under production conditions.

Helper Tool

The new helper can be built with:

make build-tools

and then used like:

build/tools/git-x509-cert HEAD
build/tools/git-x509-cert --pem HEAD > signer.pem
build/tools/git-x509-cert --all

It uses:

• certutil -dump on Windows
• openssl x509 -text -noout on Linux/macOS

Validation Performed

• go test ./cmd/git-x509-cert ./ietf-cms ./ietf-cms/timestamp ./... -run 'TestExtractCommitSignaturePEM|TestGetSignerCertificates|
  TestFindUserIdentity|TestSign'
• make build-tools
• manual validation of signed commits and certificate extraction in a real repo

Build Notes

• make build-linux succeeds
• make build-windows and make build-darwin now fail early with explicit missing-tool messages if the required cgo cross-toolchains are
  not installed

Commit Structure

• signed docs/tooling
• hardening: tighten identity selection and runtime safety

Residual Risk / Follow-Up

• This is a pragmatic hardening pass, not a complete formal security audit.
• Trust warnings still intentionally distinguish “valid signature” from “trusted CA.”
• If desired, a next follow-up could add CI coverage for cmd/git-x509-cert plus more explicit tests around helper behavior on non-leaf
  embedded chains.