Package "codesign" on Darwin

[matthewbauer]

Issue description

It looks like Apple publishes sources for its codesign utility:

https://opensource.apple.com/source/Security/Security-57031.40.6/codesign_wrapper/Makefile.auto.html

This is a good first step toward fixing #18420 and #17406. Once "codesign" is available in the environment we can start doing something like this for gdb:

gdb_signed = buildEnv {
  name = "gdb-signed";
  paths = [ gdb ];
  postBuild = ''
    ${darwin.codesign}/bin/codesign -s ${cert} $out/bin/gdb
  '';
}

Where "cert" can be provided as a config option to Nixpkgs (and eventually we can configure it on the Hydra build machines).

[LnL7]

I made a wip commit for codesigning based on the security wrapper module from nixos. But it does this on every rebuild and signing depends on an interactive password prompt.

LnL7/nix-darwin@a008b2e