Harden our code signing on macOS for ESR 91

While legacy/trac#32506 (moved) might be not doable during our transition to ESR 78 we might be able to pick up some improvements nevertheless, see:

Edited Jun 26, 2021 by Georg Koppen

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information