This is replacing tools/update/publish_version.sh

Use --batch --no-tty to avoid an error when running the script without
a tty:

  gpg: cannot open tty `/dev/tty`: No such device or address

- Automatically change to ~/$tbb_version directory
- Allow setting password with an environment variable (useful for
  tor-browser-build#40476)
- Make it possible to run the script as any user, and only run the
  osslsigncode command as the yubishm user

Update linux-signer-authenticode-signing to version currently in use.

- Automatically change to ~/$tbb_version directory
- allow setting password with an environment variable (useful for
  tor-browser-build#40476)

Update linux-signer-gpg-sign to the version currently in use.

- get tbb_version, and bundle_locales from config
- automatically change to ~/$tbb_version directory

Update macos-signer-stapler to the version currently in use.

- get tbb_version, bundle_locales and macos_notarization_user from
  config
- automatically change to ~/$tbb_version directory
- add text to ask for notarization password
- cleanup

Update macos-signer-notarization to the version currently in use.

- get tbb_version and BUNDLE_LOCALES from config
- automatically change to ~/$tbb_version directory
- unlock keychain
- use entitlements.xml from script directory
- allow setting password with an environment variable (useful for
  tor-browser-build#40476)
- cleanups

Update macos-signer-gatekeeper-signing to the version currently in use.

Update stable.entitlements.xml with the version currently in use on the
signing machine.

- automatically change to bundle directory
- allow setting password with an environment variable (useful for
  tor-browser-build#40476)
- some cleaning

This is a copy from tor-browser-bundle/gitian/signmars.sh that we
currently use for mar signing.

Automatically change to the signed directory before creating the
sha256sums-signed files.