Building: Windows: Set EXE checksums (#5579).

[bwoodsend]

#5579 explains the what/why for this PR well.

Windows executables contain an optional checksum to protect against corruption. It turns out that several of antiviral programs
raise false positives if this checksum is missing or wrong. Setting this checksum appeases McAfee and inconsistently fixes
MS Defender which are probably the most common (and also dumbest) AVs for Windows.

Sod's law says that in a few months the AV programs will notice that we've rumbled their I am not a virus metadata tag and come up with something even less effective to waste our time with but in the meantime we get to enjoy a little ironical break from the constant false-positive reports.

This PR sets the checksum for built executables. We probably should apply this directly to the bootloaders too but I can't do anything to that wafscript. I've spent several hours trying to work out how to get waf to run 3 lines of code in the right place.

Closes #5579 .

[bwoodsend]

I notice gcc automatically sets the checksum for any executable or shared library it produces but MSVC doesn't.

[BoboTiG]

Well, if it helps AVs to calm down, it is good thing!

[rokm]

Sod's law says that in a few months the AV programs will notice that we've rumbled their I am not a virus metadata tag and come up with something even less effective to waste our time with but in the meantime we get to enjoy a little ironical break from the constant false-positive reports.

Well, if nothing else, this adds a bit more entropy to the bootloader part of the frozen executable. So those poor AV engines will need to learn to ignore the bytes that correspond to the PE checksum. (Want to add some more entropy? Set the build timestamp of the final executable based on SOURCE_DATE_EPOCH or current time...).

We probably should apply this directly to the bootloaders too but I can't do anything to that wafscript.

Looks like this could be achieved by setting a linker flag.

E.g., add this to wscript on line 313:

        [...]
        ctx.env.append_value('CFLAGS', '/EHa')
        
        # Set the PE checksum on resulting binary
        ctx.env.append_value('LINKFLAGS', '/RELEASE')

Of course, once we append package data, this needs to be recomputed again anyway, but it might prevent AVs from deleting bootloader files during PyInstaller installation...

[bwoodsend]

Hmph, how'd you work that out so quickly. Been scowling at it all afternoon.

/RELEASE flag has been set. This just leaves a very narrow interval between an EXE being assembled from bootloader + PYZ etc and it getting rewritten with the correct checksum. I hope this is too small an interval for AV to intercept but past issues we've seen (#5479) make me think that anything's possible.

[bwoodsend]

Boo yah! Long may this live.