ci: Extend packaging pipeline to sign macOS binaries automatically

Add signing and notarization on macOS in a dedicated job that runs with
access to a code signing certificate and notarization credentials.