osx: Use CodeSignOnCopy for privileged helper, as suggested by XCode