Update macOS signing script to support notarization and adjust provisioning profile location

src/tools/signing/macos/mach_commands-py.patch

@@ -1,14 +1,29 @@
 diff --git a/tools/signing/macos/mach_commands.py b/tools/signing/macos/mach_commands.py
-index a513ad723805459c194d27b42dac68e9babba468..2988a1b73ce10edf4a155a1bb6bae2945a8929e0 100644
+index a513ad723805459c194d27b42dac68e9babba468..be74acbfe16a4eb389bc7d0ba32820b82fe2819c 100644
 --- a/tools/signing/macos/mach_commands.py
 +++ b/tools/signing/macos/mach_commands.py
-@@ -342,6 +342,9 @@ def macos_sign(
+@@ -37,7 +37,6 @@ from mozbuild.base import MachCommandConditions as conditions
+     "Release channel entitlements, but the configuration used will be the "
+     "Release configuration as defined in the repo working directory, not the "
+     "configuration from the revision of the earlier 120 build.",
+-    conditions=[conditions.is_firefox],
+ )
+ @CommandArgument(
+     "-v",
+@@ -342,6 +341,7 @@ def macos_sign(
      cs_reset_cmd = ["find", app, "-exec", "codesign", "--remove-signature", "{}", ";"]
      run(command_context, cs_reset_cmd, capture_output=not verbose_arg)
  
-+    # Move ./embedded.provisionprofile to [app]/Contents/embedded.provisionprofile
 +    run(command_context, ["mv", "./embedded.provisionprofile", os.path.join(app, "Contents")], capture_output=not verbose_arg)
-+
      if use_rcodesign_arg is True:
          sign_with_rcodesign(
              command_context,
+@@ -567,7 +567,7 @@ def sign_with_rcodesign(
+     # input path and its options are specified as standard arguments.
+     ctx.log(logging.INFO, "macos-sign", {}, "Signing with rcodesign")
+ 
+-    cs_cmd = ["rcodesign", "sign"]
++    cs_cmd = ["rcodesign", "sign", "--for-notarization"]
+     if p12_file_arg is not None:
+         cs_cmd.append("--p12-file")
+         cs_cmd.append(p12_file_arg)