Enable Hardened Runtime on macOS

[lunacookies]

Using the Hardened Runtime without any exceptions set means pipes-rs cannot access the user’s camera, microphone, location, address book, calendar or photo library. Moreover, a third party can no longer inject code into pipes-rs by:

• modifying dynamic libraries that pipes-rs uses
• using the macOS equivalent of LD_PRELOAD
• exploiting bugs in runtime machine code generation
• attaching a debugger and patching the program as it’s running

If someone really really needs to debug a release build (like that’s ever gonna happen lol) then removing the signature from the binary and signing it again without the Hardened Runtime is easy enough:

$ codesign --remove-signature $(which pipes-rs)
$ codesign --sign - $(which pipes-rs)

[lhvy]

Should probably bump the version after this