Consider doing deeper Apple code signing verification

[riastradh-brave]

See discussion in sparkle-project#523 for background on using kSecCSCheckNestedCode and/or kSecCSStrictValidate. The danger is that this may cause compatibility issues with older versions of macOS; see the reference for details.