Build, sign, notarise, & upload on OS X (#687)

* sign & notarise darwin package

* upload bundle as github release

* allow unsigned build and full build with release

* deref darwin bundle symlinks only when building on win32

Windows [mangles symlinks](https://github.com/electron/electron-packager/issues/71). Currently we work around this by placing several copies of the frameworks in OS X app bundles (see 1e5aa3867d). However:

- This is invalid: the framework toplevel must [only contain symlinks](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPFrameworks/Concepts/FrameworkAnatomy.html). `codesign` [refuses to sign](https://stackoverflow.com/questions/25969946/osx-10-9-5-code-signing-v2-signing-a-framework-with-bundle-format-is-ambiguou) this invalid structure.

- It seriously bloats the bundle.

Since there's no fix for the Windows misbehaviour, keep the workaround, but only when cross-building on win32 for darwin; and log a warning.

gulp/entitlements.plist

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.debugger</key>
+    <true/>
+  </dict>
+</plist>