Need better docs on Mac signing

[agocke]

There are a couple things we should document here:

• What needs to be signed (self-contained vs single-file vs AOT)
• Where Apple documentation can be found for that
• What entitlements are needed for .NET

I think there are also a few things we might be able to do specifically in the host and host publish:

• Document the PrepareForBundle target
• Investigate attaching the default .NET entitlements to the apphost and single-file host. I wonder if the entitlements will be preserved when people resign the binaries, which would make things a lot easier since they wouldn't have to look it up.

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[agocke]

cc @elinor-fung if you end up having time to look at this