feat(sign): add sign command to sign Emacs.app bundles with codesign

The sign command signs Emacs.app application bundles with Apple's
codesign utility.

It does a few things outside of just executing codesign:

- Is aware of *.eln native-compilation files, which need to be
  explicitly searched for on disk and passed to codesign, as they are
  not detected when using the "--deep" option.
- Is aware of Contents/MacOS/bin/emacs CLI helper tool which we add into
  the application bundle, and specifically passed it to codesign as
  well.
- By default provides a set of entitlements which are relevant for Emacs
  when running codesign.

pkg/cli/cli.go

@@ -45,6 +45,7 @@ func New(version, commit, date string) *CLI {
 			},
 			Commands: []*cli2.Command{
 				planCmd(),
+				signCmd(),
 				{
 					Name:    "version",
 					Usage:   "print the version",