Fix updater app copy preserving framework symlinks

[constansino]

Fixes #3218.

Summary

• replace the updater's cp -rf app copy with /usr/bin/ditto
• share the app install step between both updater launch paths
• preserve framework bundle symlinks from the mounted DMG so Gatekeeper keeps accepting the installed app

Verification

• bash -n Kit/scripts/updater.sh
• Ran Kit/scripts/updater.sh against a fake Stats.app containing framework-style symlinks and confirmed Test.framework/Test, Test.framework/Resources, and Test.framework/Versions/Current remain symlinks after install.
• Reproduced the released v2.12.14 DMG behavior locally: cp -rf copy is rejected by spctl with bundle format is ambiguous, while a ditto copy is accepted as Notarized Developer ID.

[exelban]

hi, thanks for you contribution. LGTM, but I have a few comments, maybe it's good to use ditto instead of /usr/bin/ditto just in case someone has different configuration etc. Second, because you move that call to the separate function please also add a check if ditto is available -> if yes, otherwise use cp -rf