Add option to skip signing of runtime on macOS

By default, NBPackage deep re-signs the whole of the installation payload on macOS. This ensures everything is signed with the hardened runtime and correct entitlements. When first written this proved necessary to pass notarization requirements. This might no longer always be the case, and it can cause subtle issues with things like jlink. See mailing list conversation at https://lists.apache.org/thread/gm8rst0ppmflfg38trdfvglb6dgfjzc3

We should provide an option to skip re-signing of the JDK runtime in certain cases where the user can determine this is unnecessary.