Codesign MacOS binaries

[zerok]

Right now the raw MacOS binaries offered for releases are not signed so folks using them always need to manually approve them in the MacOS security settings.

Acceptance criteria

• Given a macOS binary created during the release and a user on macOS
  • When the user launches the binary after downloading it
    • Then no “tk-darwin-arm64” can’t be opened because Apple cannot check it for malicious software. popup should appear
    • Then the tk binary should launch as expected

[zerok]

Perhaps we can even use https://github.com/anchore/quill to not require a MacOS VM.