Add a helper tool to copy web app shims to their final destination

When using ad-hoc signing for web app shims, the final app shim must be
written to disk by this helper tool. This separate helper tool exists so
that binary authorization tools, such as Santa, can transitively trust
app shims that it creates without trusting all files written by Chrome.
This allows app shims to be trusted by the binary authorization tool
despite having only ad-hoc code signatures.

Care is taken to ensure that the helper tool is only invoked by a
program signed with the same code signing identity as the Chromium
framework to ensure that the helper tool cannot be used to arbitrarily
bypass binary authorization tools.

Bug: 1465647
Change-Id: I6fc993ca3cf74add2f68ba6e837007ec1ef0e7ba
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5080017
Reviewed-by: Daniel Murphy <dmurph@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Mark Rowe <markrowe@chromium.org>
Reviewed-by: Marijn Kruisselbrink <mek@chromium.org>
Reviewed-by: Dirk Pranke <dpranke@google.com>
Cr-Commit-Position: refs/heads/main@{#1258161}

• chrome/BUILD.gn[diff]
• chrome/app/framework.exports[diff]
• chrome/app/framework.order[diff]
• chrome/browser/BUILD.gn[diff]
• chrome/browser/web_applications/BUILD.gn[diff]
• chrome/browser/web_applications/os_integration/web_app_shortcut_copier_mac.mm[Added - diff]
• chrome/browser/web_applications/os_integration/web_app_shortcut_copier_main_mac.cc[Added - diff]
• chrome/browser/web_applications/os_integration/web_app_shortcut_mac.mm[diff]
• chrome/installer/mac/signing/parts.py[diff]
• chrome/installer/mac/signing/parts_test.py[diff]