Support library constraints

[indygreg]

This looks to be a new feature in Apple code signing. Unsure how widely it is used or urgency of supporting it. Filing the issue so we have something tracking it.

[roblabla]

Library constraints is part of a larger feature called "Environment Constraints":

https://developer.apple.com/documentation/security/defining_launch_environment_and_library_constraints?language=objc

https://developer.apple.com/videos/play/wwdc2023/10266/

[indygreg]

Thanks. We already have #83 on file for launch constraints as well. I figured I'd file separate tracking issues since they are exposed as different features in codesign's CLI.

[hafta]

We'd like to adopt this (and launch constraints) for Firefox. We have bug https://bugzilla.mozilla.org/show_bug.cgi?id=1858573 on file for it. It's not urgent.

[indygreg]

Going to close this as a dupe of #83 since it looks like library and launch constraints are nearly identical at the code signing level. Doesn't make sense to track them separately.