application-identifier entitlement in Simulator

#63 describes how entitlements are not applied unless a provisioning profile is set. To an extent, this is an expected behavior as some entitlements require replacing variables like `$(AppIdentifierPrefix)` which require a provisioning profile in order to get that value.

This gets a little trickier with Simulator builds as they do not explicitly require entitlements or a provisioning profile in order to build. When building with Xcode 8 targeting iOS 10 Simulator, Xcode will always add the `application-identifier` entitlement regardless of your entitlement settings. This entitlement seems to be required to use certain APIs, for instance the Keychain API via `Security.framework`.

I've created a workaround that wraps `ios_application` and adds a `__entitlements` text segment with a blank value for `application-identifier` when the value for `provisioning_profile` is not set. This seems to work to make those APIs available again, but I'm not sure how sound of a solution it is or if it may cause other problems.

Perhaps this is a thing that the bazel apple rules should do automatically to give it more parity with how Xcode does simulator builds?

Start by reading issue #63 and the ios_application behavior described here, then reproduce an Xcode 8 iOS 10 Simulator build with and without a provisioning profile. Compare the generated entitlements, especially application-identifier, and verify whether the proposed blank value restores Security.framework Keychain access without affecting other builds.

Written by the indexing model from the issue text.