ci: fix mac library build to sign and notarize library (#7765)

* ci: fix mac library build to sign and notarize library

* script

* sign and notarize to test

* remove test build

---------

Co-authored-by: Evgeny @ SimpleX Chat <259188159+evgeny-simplex@users.noreply.github.com>

docs/contributing/RELEASES.md

@@ -54,7 +54,7 @@ pypi.<package>.<version>    commit of the publication
 
 3. Run of `build.yml`:
    - `maybe-release`: version claimed for the commit in `releases.toml`, draft `core-<version>` created
-   - build jobs: 6 library zips uploaded
+   - build jobs: 6 library zips uploaded; macOS libraries signed with the Developer ID and notarized
    - `releases`: release published
    - `publish`: `@simplex-chat/types` published, when its version is unpublished
    - `record`: types version recorded
@@ -141,6 +141,7 @@ Versions unpublished after a failure: published by the next push to the branch.
 
 - simplex-chat-libs: release immutability enabled
 - secret `NODEJS_REPO_TOKEN`: contents of simplex-chat-libs, read and write
+- secrets `APPLE_SIMPLEX_SIGNING_KEYCHAIN`, `APPLE_SIMPLEX_NOTARIZATION_APPLE_ID` and `APPLE_SIMPLEX_NOTARIZATION_PASSWORD`: signing and notarization of the macOS libraries, shared with the desktop app build
 - trusted publisher of `simplex-chat` and `@simplex-chat/types` on npm and of `simplex-chat` on PyPI: workflow `build.yml`
 - secrets `NPM_TOKEN` and `PYPI_API_TOKEN`: used instead of trusted publishing when set
 - variables `NPM_SCOPE`, `PYPI_PROJECT`, `PYPI_URL` and `PYPI_UPLOAD_URL`: publication under other names, for test repositories