OSX XProtect signature DB virtual table

This enumerates the local system's XProtect signatures.

Also: fixes a plist parsing bug and moves test data into ./tools/tests/.