Replace `altool` exec with `notarytool` or the new rest API

[directionless]

During WWDC22 Apple announced that there's a new rest API for notarization. This is exciting, and it will let is replace the shell exec in applenotarization.go with something nicer.

Not yet clear if we should:

1. replace with a shell exec of altool
2. Write something against that API (and also pull in S3)
3. See if someone else has a nice implementation
4. Maybe relic will do something, and then we can cross compile and sign for macOS?

At least today, I'm most curious about (2) and (4), but happy to wait a couple weeks to see what appears