tools/sign-dmg.py: quote variables in the codesign requirements template.

The 'mumble-g15-helper' binary failed to be code-signed
due to dashes in its name (for non-bundles, the binary's
basename itself is used as its identifier).

This commit modifies our codesign requirements template
to always quote variables that are strings.