[macOS] Add package/sign/notarise script

[angerman]

Signing and notarisation needs keys, and likely needs to be done on some separate machine.
The best would be if we had a script that could be copied alongside some files and then shipped
to the target machine, where running it would provide some minor UI to select the signing key,
and notarisation credentials; do the signing and then provide the artefact (stapled?) to be shipped somewhere.