Harden our code signing on macOS for ESR 78

While #32506 (moved) might be not doable during our transition to ESR 78 we might be able to pick up some improvements nevertheless, see:

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information