guix: Use osslsigncode 2.14

Versions prior to osslsigncode 2.14 unconditionally perform a full verification
of the binary after signatures are attached. This verification requires
having a reasonably up to date root CA file, and since 2.6, CRLs are
validated which requires network access.

The current manifest is both missing the root CA file, and the guix
container does not and should not have network access.

Our current guix time-machine has 2.13, while bumping it would give us
2.14, that seems to be problematic for other packages, see #36233
and #35855. Instead this copies in the package for osslsigncode 2.14 from
guix.