tdf#158090: Do not auto-reject SignatureState::BROKEN in ALWAYS_EXECUTE case
It doesn't make sense to silently reject it here, but e.g., allow the
confirmation dialog for SignatureState::INVALID case; also, it was only
possible to get a silent execution of BROKEN-signature macros (in Low
security mode) vs. silent reject (in all higher modes) - which was not
good security-wise. Now it will result in the usual confirmation dialog
in Medium security mode.
Both BROKEN and INVALID signature states are made sure to not allow
automatically depending on the Windows Security Zone.
Change-Id: I41b0fc96b6bd00e960ae612e79fa1f0f1e06a069
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159153
Tested-by: Jenkins
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159275
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>