Verify code signatures recursively

[jspahrsummers]

Use kSecCSCheckNestedCode when validating the code signature of an update. Suggested by @keithduncan.

This means independently signing all of the dependencies and helpers we ship in our app bundle.

[keithduncan]

kSecCSCheckNestedCode appears to be broken on Mavericks