These entitlement configurations are used when GN arg codesigning_identity is set to non-empty string.

They must be kept in sync with entitlements used for codesigning releases: