Add option to verify updates before extraction

[zorgiepoo]

Adds an opt-in option (SUVerifyUpdateBeforeExtraction) to enforce verifying updates before extracting them for stronger security. EdDSA signing is required to use this option. As fallback in case EdDSA keys are lost, disk image archives's code signatures are validated assuming it's Developer ID signed. Key rotation is still possible.

Apple Archives (aar, yaa) now require using this option.

Fixes #2590

Misc Checklist

• My change requires a documentation update on Sparkle's website repository
• My change requires changes to generate_appcast, generate_keys, or sign_update

Testing

I tested and verified my change by using one or multiple of these methods:

• Sparkle Test App
• Unit Tests
• My own app
• Other (please specify)

• Updating Sparkle Test App with zip works (EDDSA signed, adhoc bundle signed, SUVerifyUpdateBeforeExtraction = YES)
• Updating Sparkle Test App with zip works (EDDSA signed, adhoc bundle signed, SUVerifyUpdateBeforeExtraction = NO)
• Updating app with zip works (EDDSA signed, Developer ID signed, SUVerifyUpdateBeforeExtraction = NO)
• Updating app with aar works (EDDSA signed, Developer ID signed, SUVerifyUpdateBeforeExtraction = YES)
• Updating app with aar fails (EDDSA signed, Developer ID signed, SUVerifyUpdateBeforeExtraction = NO)
• Updating app with aar fails (EDDSA signed, Developer ID signed, SUVerifyUpdateBeforeExtraction omitted (same as NO))
• Updating app with SUVerifyUpdateBeforeExtraction with code signed Developer ID fails when both old/new EdDSA signature fails (but Apple code signing validation succeeds!)
• Updating app with SUVerifyUpdateBeforeExtraction with code signed Developer ID fails when both EdDSA signature fails and dmg archive is not code signed
• Updating app with SUVerifyUpdateBeforeExtraction with code signed Developer ID fails when both EdDSA signature fails and dmg archive is adhoc signed (but not Dev ID signed matching original app)
• Updating app with SUVerifyUpdateBeforeExtraction with code signed Developer ID succeeds when EdDSA signature succeeds and dmg archive is adhoc signed (but not Dev ID signed matching original app)
• Using SUVerifyUpdateBeforeExtraction without any EdDSA key does fail
• Using new EdDSA key, same developer ID signing from dmg, rotation works (SUVerifyUpdateBeforeExtraction = YES)
• Using new EdDSA key, adhoc signing on bundle, developer ID signing from dmg, fails (b/c adhoc sig has no team id) (SUVerifyUpdateBeforeExtraction = YES)
• Using new EdDSA key, development cert (not developer ID) signing on bundle, developer ID signing from dmg, succeeds (b/c even though old app is signed with wrong cert, it has same team id, and new download is validated with that team id & developer id signing) (SUVerifyUpdateBeforeExtraction = YES)
• Using new EdDSA key, development cert (not developer ID) signing on bundle, development cert (not developer ID) signing from dmg, fails (b/c archive needs to be Developer ID code signed, even though team ids match) (SUVerifyUpdateBeforeExtraction = YES)

macOS version tested: 15.1 (24B83)