Sign and notarize the DMG with a Developer ID #4

Release DMGs are currently ad-hoc signed. Because of that, macOS blocks the first launch of a downloaded copy, and people have to open System Settings › Privacy & Security and click Open Anyway once.

The packaging from #3 already handles signing. Once the credentials exist, turning it on means adding repository secrets, with no code changes.

To do

• Join the Apple Developer Program ($99/year).
• Create a Developer ID Application certificate and export it as a .p12.
• Create an app-specific password for the Apple ID.
• Add the repository secrets: MACOS_CERTIFICATE (base64 .p12), MACOS_CERTIFICATE_PASSWORD, MACOS_SIGN_IDENTITY, APPLE_ID, APPLE_TEAM_ID, APPLE_APP_PASSWORD. The README's "Releases" section has the details.
• Tag a release and confirm spctl --assess accepts the DMG and that a downloaded copy opens with no warning.
• Remove the "Open Anyway" note from the README and release notes.