Run CPack in a separate job for nightly binaries, and not at all for
release binaries.  Unlike macOS disk images (.dmg), we cannot sign the
binaries inside Windows installers (.msi) after-the-fact.  Instead,
produce enough artifacts from the build job to sign and package release
binaries manually.

Port build settings from `Utilities/Release/win/x86/Dockerfile` and its
helper scripts.