We need to individually sign each Mach-O file independently, otherwise
notarization bails.  Note that you must sign the overall `.app` after
each individual file is signed.

I've also added more Entitlements.

I've gone for a "gentle shotgun" approach, turning on everything that I think
we could reasonably want.  I wait expectantly for someone to complain that
they need Location access turned on for some package.  ;)

(cherry picked from commit 418f111)

fixes #29859

(cherry picked from commit 8a55a27)

add null check for module-default-defs, fix #34544

fix #35367 as well

change jl_eval_module_expr to check 3rd arg is block

(cherry picked from commit 8057c60)

It is noted as a non-OS stream, but has also been a subtype
of LibuvStream since forever. #32309 did not add the `readerror`
field.

(cherry picked from commit de04210)

Currently the case where `r == 0` falls through the same logic as every
other non-negative value of `r` (aside from 1). This works for signed
integers. However, this does not work for unsigned integers: in the loop
where we unsafely fill in the output string, we're looping from 0 to `r
- 1`, which for unsigned integers wraps around and causes us to request
the address of the output string at a location that is well beyond what
was allocated.

Fixes #35578.

(cherry picked from commit 1dcb42f)

(cherry picked from commit 0cedde6)

(cherry picked from commit 0bab06f)

…ffers (#35695)

In readbytes!(s::UVStream, buf::AbstractVector{UInt8}, nb), we wrap `buf`
in a PipeBuffer of maxsize nb and swap it in as the main buffer for the
stream `s`. However, when we inform libuv of the size of the buffer,
we instead use the size of the underlying array, which can be larger.
In that case, we probably either drop bytes or override something that
the user did not want overriden.

(cherry picked from commit 3a84b51)

(cherry picked from commit 9c2492e)

…35758)

(cherry picked from commit 880c731)

(cherry picked from commit e00db7b)

Backports release 1.4.2

(cherry picked from commit 0d0ead3)