santactl is adhoc-signed with the release rules

[tnek]

Putting into writing what markowsky@ and I have been discussing.

When creating a full Santa release with: with bazel build -c opt --define=SANTA_BUILD_TYPE=release :release and the Santa_dev and Santa_daemon_dev provisionprofiles in the appropriate places, where the provisioningprofiles contain a development certificate, santactl doesn't end up getting signed but everything else does. This of course results in all MOLXPC checks failing with the newly created santactl. Our internal release pipeline inadvertently just codesigns over this generated santactl binary with the correct certificate, so we never ran into this with the actual packaged releases.

[tnek]

Easiest way to fix this is to just add a provisioning_profile to the santactl rule, after that's supported with bazelbuild/rules_apple#1236