Fix universal macOS build for intel macs

[abotkin]

Summary of changes

These changes introduce 2 more entitlements to the macOS build so as to allow Python.framework to utilize JIT even in the Hardened Runtime enacted when code signing and notarizing Plover. In testing on 2020 iMac 5k (Intel), adding these two entitlements removed syspolicyd and kerneld complaints in Console log about ASP: Library load (/Applications/Plover.app/Contents/Frameworks/Python.framework/Versions/3.13/bin/python3.13 -> /private/var/tmp/ffiEbrT6c) rejected: library load disallowed by system policy and the app successfully launches. Also ran the same binary on M1 Mac Mini and similarly successful launch (no change in behavior).

In addition, changes are made to ensure that the Python.framework standalone is made completely Universal as some wheels in site-packages were not Universal. This code is largely based off of Greg Neagle's Python Universal Tester in the relocatable-python repo.

A quality of life change is also made to CI to not attempt to submit to PyPI when GitHub Actions are run from forked repos. This allows for folks to safely enable the GitHub Actions workflow without causing issues for the project.

Closes #1805

Pull Request Checklist

• Changes have tests
• Signed & notarized builds created on fork's release page via GitHub Actions. Note: Bundle ID & Developer ID differ from Plover's and is only for testing of this PR
• Ran v5.3.0 test release on fork with entitlement changes on Intel Macs & Apple Silicon Macs successfully
• News fragment added in news.d. See documentation for details

[mkrnr]

Thank you so much @abotkin for this super valuable contribution! It's great to have Plover fixed for intel Macs and I really like your change to skip the PyPI publishing on forked repos!