Fix MacOS Notarization (#35080)
We need to individually sign each Mach-O file independently, otherwise
notarization bails. Note that you must sign the overall `.app` after
each individual file is signed.
I've also added more Entitlements.
I've gone for a "gentle shotgun" approach, turning on everything that I think
we could reasonably want. I wait expectantly for someone to complain that
they need Location access turned on for some package. ;)
(cherry picked from commit 418f1114a4a97524849bc3cb3077306a0b27691b)