OS X code signing fixes

Remove unnecessary Python executables and stuff that complicates code
signing in the test-install target.

Sign executables in codesign-macosx-app-bundle, not when building
them. It is more uniform to do all code signing in just one place.

All executables must have the com.apple.security.app-sandbox entitlement.

Change-Id: Ic6a640eb03964fe9ce75d3a8fff071971a3e1939
Skip some executables in the OS X sandboxed (Mac App Store) case

I doubt end-users will miss gengal.bin, regview, or regmerge.

Change-Id: I353610c0d039f25fa415f35902fe2b9890cd423f
This test was the wrong way surely?

Change-Id: I3470fbd2992cd96a772452d75fb2f0320bb529bf