Add ci/macos.Jenkinsfile and supporting scripts for producing
signed and notarized macOS builds of the CLI:
- scripts/sign-and-notarize.sh: signs all Mach-O files in the
cli-bundle-dir output (dylibs, Qt framework binaries, bin/
executables) with Developer ID + hardened runtime + timestamp,
then submits to Apple notary service.
- No stapling since tickets can't be stapled to flat dirs/tarballs,
Gatekeeper verifies online.
Ref.: https://github.com/logos-co/logos-logoscore-cli/issues/53
