Improve update experience on MacOS

[TicClick]

if an executable is downloaded from an unknown source, MacOS will require you to run it from the UI for the first time and explicitly approve the launch, which poses a huge usability issue

• (also, I need to double-check platform matching -- got the impression that it pulls wrong binaries)
• GitHub Action: New M1 runner available to all plans, including open source 🚀 actions/runner-images#9254

[TicClick]

to comment on my initial suspicion, it only happens once -- subsequent updates don't trigger MacOS' defence mechanisms. which is good and more or less similar to other platforms (and to what I expected)

also we now have Apple Silicon builds