Fix the unsigned Windows installer build, and install syft for it

Two problems, one of them in the packaging rather than the workflow.

installer.iss.in has always carried an unconditional `SignTool=pgAdminSigntool`,
but Make.bat only defines that SignTool when PGADMIN_WINDOWS_CSC is set. So the
unsigned path, which Make.bat explicitly supports and announces ("Skipping code
signing"), cannot actually produce an installer: ISCC aborts with "Value of
[Setup] section directive SignTool is invalid". It has presumably never been
exercised, because the Jenkins Windows job runs on the box with the token
plugged in, where the variable is always set.

Both signing directives are now inside `#ifdef SIGNED`, and the signing branch
of Make.bat passes /DSIGNED next to the existing /SpgAdminSigntool=. The signed
build emits exactly what it emitted before; the unsigned build now works.

Second, and more mundane, syft isn't on the hosted image. That one was silent:
:GENERATE_SBOM redirects syft's output into sbom.json and returns 0 whatever
happens, so a machine without syft ships an empty SBOM rather than failing. The
buildfarm's Windows worker installs it via Chocolatey, so this does too.

.github/workflows/check-windows-build.yml

@@ -59,13 +59,14 @@ jobs:
       - name: Install virtualenv
         run: python -m pip install --upgrade pip virtualenv
 
-      # wget is not on the hosted image, and Make.bat's Electron download is an
-      # unbounded retry loop (Make.bat:316), so without it the build spins on
-      # error 9009 until the job times out rather than failing. The buildfarm's
-      # Windows worker gets wget from the same Chocolatey line in
-      # pkg/win32/README.md.
-      - name: Install Inno Setup and wget
-        run: choco install innosetup wget -y --no-progress
+      # None of these are on the hosted image. wget matters most: Make.bat's
+      # Electron download is an unbounded retry loop (Make.bat:316), so without
+      # it the build spins on error 9009 until the job times out rather than
+      # failing. syft generates the SBOM, and its absence is silent, since
+      # :GENERATE_SBOM redirects into sbom.json and returns 0 regardless. The
+      # buildfarm's Windows worker installs all three via Chocolatey too.
+      - name: Install Inno Setup, syft and wget
+        run: choco install innosetup syft wget -y --no-progress
 
       # The same artefacts the buildfarm's winpgbuild-update job installs. The
       # archives unpack to <DEPS_DIR>\postgresql and <DEPS_DIR>\krb5.

Make.bat

@@ -391,7 +391,7 @@ REM Main build sequence Ends
 
     ECHO Creating windows installer using INNO tool...
     IF NOT "%PGADMIN_WINDOWS_CSC%" == "" (
-        CALL "%PGADMIN_INNOTOOL_DIR%\ISCC.exe" "%WD%\pkg\win32\installer.iss" "/SpgAdminSigntool=%PGADMIN_SIGNTOOL_DIR%\signtool.exe sign /sm /n $q%PGADMIN_WINDOWS_CSC%$q /tr http://timestamp.digicert.com /td sha256 /fd sha1 /v $f" || EXIT /B 1
+        CALL "%PGADMIN_INNOTOOL_DIR%\ISCC.exe" "%WD%\pkg\win32\installer.iss" "/DSIGNED" "/SpgAdminSigntool=%PGADMIN_SIGNTOOL_DIR%\signtool.exe sign /sm /n $q%PGADMIN_WINDOWS_CSC%$q /tr http://timestamp.digicert.com /td sha256 /fd sha1 /v $f" || EXIT /B 1
     ) ELSE (
         CALL "%PGADMIN_INNOTOOL_DIR%\ISCC.exe" "%WD%\pkg\win32\installer.iss" || EXIT /B 1
     )

pkg/win32/installer.iss.in

@@ -36,8 +36,14 @@ ArchitecturesInstallIn64BitMode={#MyAppArchitecturesMode}
 AllowNoIcons=yes
 WizardImageFile=sidebar.bmp
 MinVersion={#MinimumWindowsVer}
+; Only emitted for a signing build. Make.bat passes /DSIGNED alongside the
+; /SpgAdminSigntool= definition; without both, ISCC aborts with "Value of
+; [Setup] section directive SignTool is invalid" because the named SignTool
+; was never defined.
+#ifdef SIGNED
 SignTool=pgAdminSigntool
 SignedUninstaller=yes
+#endif
 CloseApplications=yes
 
 [Languages]