Release builds should be notarized for macOS Catalina

### Description of the problem / feature request:

In macOS Catalina, Apple introduced a requirement that applications that are downloaded and run on the machine are notarized. Without this, applications refuse to run unless a user follows a non-obvious sequence of steps involving the "Security" preference pane.

Bazel releases should be notarized in order to ensure that it works as expected on macOS.

### What operating system are you running Bazel on?

macOS Catalina and above

### Have you found anything relevant by searching the web?

Mozilla also ran into (and resolved!) this problem with both Firefox and `geckodriver`:

* https://firefox-source-docs.mozilla.org/testing/geckodriver/Notarization.html
* https://bugzilla.mozilla.org/show_bug.cgi?id=1588081

Steps for notarizing applications on the command line can be found here: https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow

There may already be machinery within Google that can be harnessed for notarizing releases, which may simplify this issue considerably.