New versions of agent require re-authorisation of macOS system permissions

(I originally posted https://github.com/buildkite/homebrew-buildkite/issues/26 but the more I think about it, the more it's not a Homebrew-specific issue and it's an agent issue.)

### Background

Every time there is a new version of `buildkite-agent` installed on macOS it appears as a different app and needs to have permissions (like accessing a network volume) re-approved.


The re-authorisation process cannot* be automated as it is a macOS security feature.

(* Well, there are a couple of workarounds. One is enrolling and managing a device using MDM, which allows for profiles to be added to authorise permissions. The other is to disable System Integrity Protection (SIP) which is not ideal either.)

This involves screen sharing to each Mac and clicking a button that shows up when the first test runs. macOS stores this authorisation in the TCC database, which is read-only unless SIP is disabled.

To see the entries in the TCC database, run:
```
sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "select * from access;"
```

A good explainer of TCC can be found here: https://www.rainforestqa.com/blog/macos-tcc-db-deep-dive.

This is occurring on a bunch of Mac Minis running macOS 12.6.2 (21G320), which is the most up to date public version of macOS.

### Steps to reproduce

1. Install a version of `buildkite-agent` (such as 3.38.0).
2. Run a Buildkite job that connects to a network volume from the host.
3. Click the approval dialog that shows up to grant buildkite-agent access to the network volume or other directory requiring permissions. (See https://github.com/buildkite/agent/issues/1922#issuecomment-1396313047 for a minimal pipeline and script to replicate)
4. See that the entry is listed in the TCC database (note that the path to `buildkite-agent` is a full path including the version number, not the symlink that would come from running something like `which buildkite-agent`)
```
sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "select * from access;"

# Truncated sample output. Other apps may also appear here if you've granted them permission to, say, use the camera or microphone
kTCCServiceSystemPolicyNetworkVolumes|/opt/homebrew/Cellar/buildkite-agent/3.38.0/bin/buildkite-agent|1|2|2|1||||UNUSED||0|1666063609
```
5. Install a new version of `buildkite-agent` and repeat step 2.

#### Expected behaviour

`buildkite-agent` will have access to previously approved permissions.

#### Actual behaviour

Each version is seen as a completely new program and needs to have permissions granted again.

No source file or test is named. Start by reproducing the issue with two buildkite-agent versions on macOS and inspect the TCC database entry for the versioned executable path. Done means a newly installed agent retains previously approved permissions, or the issue documents a confirmed platform limitation and supported workaround.

Written by the indexing model from the issue text.