Prevent the "Update available" Sparkle popup on Mac

[mherrmann]

It was shown when Brave was run as non-admin user and tried to update a system-wide installation.

Resolves brave/brave-browser#9562

Submitter Checklist:

• I confirm that no security/privacy review is needed, or that I have requested one
• There is a ticket for my issue
• Used Github auto-closing keywords in the PR description above
• Wrote a good PR/commit description
• Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
• Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
• Checked the PR locally: npm run test -- brave_browser_tests, npm run test -- brave_unit_tests, npm run lint, npm run gn_check, npm run tslint
• Ran git rebase master (if needed)

Reviewer Checklist:

• A security review is not needed, or a link to one is included in the PR description
• New files have MPL-2.0 license header
• Adequate test coverage exists to prevent regressions
• Major classes, functions and non-trivial code blocks are well-commented
• Changes in component dependencies are properly reflected in gn
• Code follows the style guide
• Test plan is specified in PR before merging

After-merge Checklist:

• The associated commits in github.com/brave/Sparkle were merged into the main Git branch there.
• The associated issue milestone is set to the smallest version that the
  changes has landed on
• All relevant documentation has been updated, for instance:
  • https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)
  • https://github.com/brave/brave-browser/wiki/Proxy-redirected-URLs
  • https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections
  • https://github.com/brave/brave-browser/wiki/Brave%E2%80%99s-Use-of-Referral-Codes
  • https://github.com/brave/brave-browser/wiki/Custom-Headers
  • https://github.com/brave/brave-browser/wiki/Web-Compatibility-Exceptions-in-Brave
  • https://github.com/brave/brave-browser/wiki/QA-Guide
  • https://github.com/brave/brave-browser/wiki/P3A

Test Plan:

This PR has the potential to brick Brave's update fleet on macOS. It is therefore very important to test it thoroughly.

Affected functionality

This PR affects the following functionality:

1. Silent, background updates. These take place after the second time Brave is started on a user's system, and while Brave is running. The functionality silently downloads and applies updates in the background. On the next start of Brave, the new version should then be in effect.
2. On-demand updates. These are kicked off when the user visits brave://settings/help.

Especially the first one 1. should be tested carefully. If this breaks, then Brave's entire macOS fleet will no longer receive updates and users would have to update manually.

Scenarios to test

At least the following scenarios should be tested, with the most important ones listed first:

1. Silent, background update when Brave is run as a user with admin rights.
2. On-demand update when Brave is run as a user with admin rights.
3. On-demand update when Brave is run as a guest user without admin rights.
4. Silent, background update when Brave is run as a guest user should be disabled.

Here's how to test them:

"1.": Ideally, there is already a newer release of Brave. So say you have v1.2.3 (which includes the changes from this PR) and there is 1.2.4 on github.com/brave/brave-browser/releases. Then you would install v1.2.3 into /Applications. Start Brave once. Make sure brave://settings/help is not open. (Otherwise, that page would trigger an on-demand update check now or on the next launch of Brave). Close Brave. Wait for 3 hours. (Maybe it also works to change the system time.) Start Brave again and wait for a few minutes. Close Brave. Open brave://settings/help. It should now say it's at version 1.2.4. There should not have been any "Update available" popup as shown in the screenshots in brave/brave-browser#9562.

If the above does not work, then you can inspect the logs by launching Brave with the following command in a terminal:

/Applications/Brave\ Browser\ Nightly.app/Contents/MacOS/Brave\ Browser\ Nightly --enable-logging=stderr --vmodule=sparkle_glue=5,brave_relaunch_handler_mac=5 2>&1

The following command in a terminal should also show some interesting output if an update gets applied:

log stream | grep -i sparkle

"2.": Install Brave "1.2.3" (see "1." above) into /Applications and (as a user with admin rights) open brave://settings/help. An update should be applied but no update popup should be visible. Relaunch Brave and check that brave://settings/help shows the new version. There should not have been any "Update available" popup as shown in the screenshots in brave/brave-browser#9562.

"3.a)": Repeat "2." but execute Brave as a non-admin user. The update should be applied. Relaunch Brave. This should open a dialog asking you to grant admin permissions for the update modifications. Grant admin permissions. The new version of Brave should launch. brave://settings/help should show the new version. There should not have been any "Update available" popup as shown in the screenshots in brave/brave-browser#9562.

"3.b)": Repeat "3.a)" but do not grant admin permissions after relaunching Brave. This will likely prevent Brave from opening on the first time. But when you open Brave again, it should work successfully and brave://settings/help should show the old version.

"4.": Repeat "1." but execute Brave as a non-admin user. No update should be applied. Be careful not to open brave://settings/help, because that would apply an update. There should also not be an "update available" popup.

[mherrmann]

@bridiver @mkarolin this PR touches DEPS. Could I ask for your review? Requesting your review on the right through GitHub isn't working for me, I believe due to a permission issue.

[mkarolin]

++