fix: enable macOS WebAuthn platform authenticator

[100 (4x25)]

Fixes #2436

Summary

• Include Chromium's macOS branded entitlement template in BrowserOS's unbranded build so GN generates the WebAuthn keychain groups and platform-credential entitlement.
• Propagate the configured macOS Team ID into Chromium's BRANDING before GN runs, using MACOS_TEAM_ID with PROD_MACOS_NOTARIZATION_TEAM_ID as the CI fallback.
• Prefer GN-generated app entitlements during signing, including the per-architecture outputs used by universal builds.

Validation

• uv run python -m unittest bos_build.steps.resources.chromium_replace_test bos_build.steps.sign.macos_test — 36 passed.
• uv run ruff check on all changed Python files — passed.
• git diff --check — passed.
• The patch applies cleanly to Chromium 151.0.7922.137 with git apply --check.
• Full bos_build suite: 1139 passed, 2 skipped, 1 unrelated existing fixture-version failure in release/feeds/publisher_test.py.
• A full Chromium compilation was not run locally.

[greptile-apps]

PR author is not in the allowed authors list.

[github-actions]

All contributors have signed the CLA. Thank you!
_{Posted by the CLA Assistant Lite bot.}

[100 (4x25)]

I have read the CLA Document and I hereby sign the CLA