[ZhuchkaTriplesix]

Closes #1588.

MacosSparkleInstaller._verifyCodesign ran codesign --verify --deep --strict on the downloaded bundle. That proves the seal is intact, not who signed it: any validly signed bundle, even ad-hoc, passed and replaced the installed app.

• After the seal check, the installer reads the Team ID of the installed app and of the update (codesign -dv --verbose=4, TeamIdentifier=), and refuses the update when they differ or when the update has none.
• An installed app without a Team ID (the unsigned / ad-hoc build) has nothing to compare with. There the SHA-256 of the zip, checked against the release's SHA256SUMS.txt before this step, stays the check; that guards the transfer, not a compromised release, which the issue already notes.
• codesign runs through an injectable process runner (default Process.run), and the parsing and the decision are pure functions: parseCodesignTeamId, signerMismatchProblem.

Not verified on a Mac: the output format is codesign's documented one (TeamIdentifier=XXXXXXXXXX / not set, printed to stderr). If codesign -dv failed on a signed installed app for some other reason, the check would treat it as unsigned and let the update through, as before this PR.

Tests: Team ID parsing for a Developer ID signature, an ad-hoc one and no signature; the decision for the same team, another team, an unsigned update over a signed app, and an unsigned installed app.