fix(shared): resolve the app group identifier at runtime

[Nyvernn]

On a build that has been re-signed (TrollStore, a re-signing service, an ad-hoc
signature), the app group is renamed rather than removed: the app and the extension
still share one, but it is no longer group.cn.easytier.

containerURL(forSecurityApplicationGroupIdentifier:) then returns nil, and everything
built on it fails independently and silently while the tunnel itself keeps working:

• the core's log is written to a path nothing can read
• UserDefaults(suiteName:) is nil, so the app cannot hand the extension its config
• the widget's shared state never arrives

This reads the identifier from Entitlements -> com.apple.security.application-groups
in embedded.mobileprovision and takes the first entry that actually has a container,
falling back to the compiled-in one. A normally signed build takes the first branch and
is unaffected.

APP_GROUP_SOURCE and APP_GROUP_AVAILABLE are exposed so a bug report can state which
identifier was in use and where it came from.

[chenx-dust]

我对这个的实现方式保持怀疑，不是所有构建方式都有 provisioning file 的，并且这个修改会破坏 macOS 上的行为

[Nyvernn]

我对这个的实现方式保持怀疑，不是所有构建方式都有 provisioning file 的，并且这个修改会破坏 macOS 上的行为

研究了下。 主要看要不要支持下这种重签（AltStore、SideStore等），如果只管TrollStore，那这个PR可以关了。

然后实现方面，读profile是ok的，几KB，类似的重签都得改名，改名就有profile

最后macOS确实要加个#if os(iOS) 排除下就好

[chenx-dust]

你可以尝试验证一下 AltStore、SideStore 在有 Apple Developer 的情况下能否签名出 Network Extension 正常工作的结果。我之前测试应该是不行。