fix: preserve SSL.com signing arguments and supply sandbox config

[chenyukang]

Fix two issues in the SSL.com migration from #3506:

• Invoke the bundled Java executable with an argument array and no shell, so passwords containing percent signs, quotes, or shell metacharacters reach CodeSignTool unchanged. Preserve the bundled runtime, working directory, and in-place signing behavior.
• Check in SSL.com's public sandbox configuration and copy it from the checkout. The pinned v1.3.2 Windows ZIP does not include the demo properties file previously referenced by the workflow. Remove the ineffective mode override from the signing hook; mode selection stays in the workflow.

The sandbox values come from SSL.com's official action.

Validation: 7 focused Jest tests pass using the wallet's existing configuration, covering literal credentials and spaced paths, missing credentials, optional certificate ID, missing application path, and signing failures. Prettier, node --check, and git diff --check pass. Checked Java/JAR paths against the pinned Windows ZIP and verified the workflow's sandbox file path. Real Windows signing was not run.