Add support for xcsigningtool

With Xcode 11 Apple quietly added a new tool called xcsigningtool that allows you to sign an app without adding the certificate to the global keychain. Usage:

```
% xcrun xcsigningtool
Usage:
xcsigningtool sign -path -certificate [-entitlements ]
```

I think adding support for this where you could specify the path to a certificate as an attribute of the rules that require it would be a huge win for hermiticity and simplicity

Start by locating the Apple signing rules that currently require a certificate in the global keychain, then compare their flow with the documented `xcrun xcsigningtool sign` command. The work is done when a rule can accept a certificate path and sign an app without adding that certificate to the global keychain.

Written by the indexing model from the issue text.