Fix sign.ps1 access to Key Vault

[jarz]

After changing Key Vault networking configuration, sign.ps1 will need to be updated to add the agent's IP address to the firewall before fetching certificates. When the script finishes, it should remove the IP address from the firewall.