contrib: remove deprecated --deep codesign flag

Replace the deprecated `codesign --deep` with explicit per-component
signing of Frameworks, Plugins and the top-level bundle.

CI is updated to verify with --deep --strict.

Can be verified with:
codesign --verify --deep --strict --verbose=4 build/dist/Bitcoin-Qt.app

Co-authored-by: amisha <amishhhaaaa@gmail.com>

ci/test/03_test_script.sh

@@ -183,7 +183,7 @@ fi
 
 if [[ "$CI_OS_NAME" == "macos" && "${GOAL}" = "install deploy" ]]; then
   unzip "${BASE_BUILD_DIR}/bitcoin-macos-app.zip" -d "${BASE_BUILD_DIR}/deploy"
-  if ! ( codesign --verify "${BASE_BUILD_DIR}/deploy/Bitcoin-Qt.app" ); then
+  if ! ( codesign --verify --deep --strict "${BASE_BUILD_DIR}/deploy/Bitcoin-Qt.app" ); then
     echo "Codesigning failed."
     false
   fi

contrib/macdeploy/macdeployqtplus

@@ -488,7 +488,19 @@ with open(os.path.join(applicationBundle.resourcesPath, "qt.conf"), "wb") as f:
 # ------------------------------------------------
 
 if platform.system() == "Darwin":
-    subprocess.check_call(f"codesign --deep --force --sign - {target}", shell=True)
+    # The earlier strip and install_name_tool calls invalidated existing framework
+    # and plugin code signatures.
+    print("+ Signing app bundle +")
+    sign_targets = [
+        path
+        for pattern in ("Frameworks/*", "PlugIns/*/*")
+        for path in Path(target, "Contents").glob(pattern)
+        if path.is_file() or path.name.endswith(".framework")
+    ]
+    # Sign the app bundle last
+    sign_targets.append(Path(target))
+    for sign_target in sign_targets:
+        subprocess.check_call(["codesign", "--force", "--sign", "-", sign_target.as_posix()])
 
 # ------------------------------------------------