[signing, provisioning] Properly collect signatures from the provisioning_exts repo

[cfrantz]

Description

The signature attach rule for provisioning binaries (//sw/device/silicon_creator/manuf/base:signed) potentially depends on signature resources sourced from the @provisioning_exts repo.
1.
2. Commit signature files to @provisioning_exts instead of the main repo.
3. Add a perso_sig member to the skus dictionary from provisioning_inputs.bzl / cfg.bzl to give the label of additional signature files.
4. Concatenate and flatten lists of signatures from the external repo for the ecdsa_signatures attribute of the :signed rule.