Add BUILD_FOR_APP_STORE CMake flag (Mac App Store)

Part of: #9941

## Problem

There is no dedicated App Store build variant. Sparkle removal, entitlement differences, and `deny_autoupdate` plist installation all need to be conditioned on a build-time flag.

## Blocked by

- #9934 — the final App Store entitlements template for the main app and FinderSyncExt can only be completed once the embedded XPC service architecture is established.

## Affected files

- `NEXTCLOUD.cmake`
- `admin/osx/CMakeLists.txt`
- `src/gui/updater/CMakeLists.txt`

## Required change

Add `option(BUILD_FOR_APP_STORE "Build for the Mac App Store" OFF)` and wire it to:
- `BUILD_UPDATER` forced OFF
- A separate entitlements template without any `temporary-exception` keys
- Skipping `deny_autoupdate_com.owncloud.desktopclient.plist` installation
- Using the App Store bundle ID (see #9931)

**Note:** Proceed with the flag and other wiring first; update the entitlements template in a follow-up commit once #9934 is resolved.