CI: Option to notarize macOS builds

[jdpurcell]

Most of it is fairly boilerplate stuff that you'll find by searching how to integrate signing/notarization into CI. Adds an input to the workflow that when checked, requires the following secrets:
APPLE_DEVID_APP_CERT_DATA: Your Developer ID Application certificate exported as P12 + base64 encoded
APPLE_DEVID_APP_CERT_PASS: The export password for that certificate
APPLE_ID_USER: Your Apple ID (i.e. email address)
APPLE_ID_PASS: Not your actual Apple password; rather an app-specific password

The openssl/grep/awk stuff is just some magic to detect the common name from the certificate instead of needing to have an additional pre-defined variable or secret for it.

[jurplel]

Resolve the merge conflicts with the other PR and i will merge

[jdpurcell]

@jurplel Rebased onto master. And for proof that it works, here's a run through my Actions environment with the notarize option on.