CI: Sign and notarize macOS builds on new tags - #3444

@DDRBoxman Y u no use xcnotary? I added that to the brewfile for a reason. 😕

There's also a "proper" way to do notarisation on Github CI that doesn't require the base64 homebrew dependency and simplifies the process, I'll try to adapt this later tonight: https://github.com/PatTheMav/obs-websocket/blob/a479f529af1e5bf4214d39cec36fad6e6f101a14/.github/workflows/tag_release.yml#L395

In general notarising the dmg is enough because stapling will be applied recursively if done right, so running xcnotary on the dmg once is sufficient. I'd also suggest always codesigning on macOS anyway in prep for Apple Silicon which would also allow the dmg generated for nightlies to be codesigned (and then just be thrown at the notarisation process on a tag event).