Unexpected changes in Entitlements when building IPA

Hey Guys!
I’m trying to build IPA file using bazel, it works well, but i found a problem related to entitlements,
So in my entitlements
```
keychain-access-groups

5JYEAW4GJZ.*

```
but the problem is when i upload the IPA into app store, and check the entitlement with key keychain-access-groupsit seems have different value. I try to check it from terminal
```
codesign -d --entitlements :- "MyApp.app"
```
then i got like this
```
keychain-access-groups

5JYEAW4GJZ.com.dwirandyh.prodcution

```

Here is snippet code of my ios_application
```
ios_app(
name = "MyAppBundle",
app_icons = glob([
"Images.xcassets/AppIcon.appiconset/**",
]),
bundle_id = "com.dwirandyh.production",
bundle_name = "My Appp",
entitlements = select({
"//Config:ios-device": "Entitlements/MyApp.entitlements",
"//conditions:default": None,
}),
)
```

May i know why the wildcard is replaced with my app identifier?

Start with the ios_app snippet and Entitlements/MyApp.entitlements, then reproduce the archive and inspect the signed app with codesign -d --entitlements :- "MyApp.app". Trace where the keychain-access-groups wildcard changes during signing and determine whether the observed identifier is expected or indicates a rules_apple issue.

Written by the indexing model from the issue text.