Let’s compile the Mac OS X SecurityTool ourselves

This allows us to compile SecurityTool ourselves. There are several more Apple opensource projects that can be compiled this way that I'll slowly add.

Remaining sources of impurity:
- Reference to absolute path to Xcode. This should be integrated with the xcode derivation (and the iOS wrapper chain that exists under mobile development) but it's not obvious how to do that yet.
- Absolute reference to `xcodebuild`.

Adding this should make it possible for #3629 to work reasonably cleanly.
The environment variable `SDKROOT` already contains the path to the SDK, so no reason to hard-code it.