Add signing to build steps for CMake and qmake

Certain macOS APIs require the app to be a bundle, and signed, so that TCC can reliably get a signature for the app. E.g. UserNotifications permission can not be requested for an unsigned app.

Xcode nowadays always signs the app, for both debug and release builds. (it also registeres the app with launch services, and some other steps).

We should add logic to our cmake and qmake build systems to automatically sign apps, so that the flow in both Qt Creator and on the command line (ninja/make) produces an app that can be run and take advantage of the APIs that require signing.