Let’s compile the Mac OS X SecurityTool ourselves

This allows us to compile SecurityTool ourselves. There are several more Apple opensource projects that can be compiled this way that I'll slowly add.

Remaining sources of impurity:
- Reference to absolute path to Xcode. This should be integrated with the xcode derivation (and the iOS wrapper chain that exists under mobile development) but it's not obvious how to do that yet.
- Absolute reference to `xcodebuild`.

Adding this should make it possible for #3629 to work reasonably cleanly.
It's probably best to just use the absolute path to the sdk folder on the system; otherwise, anything depending on `osx_sdk` will try to pull down a substitute from Hydra, which is probably not good for legal and practical reasons.