[bug] Updater fails for macOS-sandboxed apps

[gschier]

Describe the bug

Sandboxed macOS apps do not have permissions to write to the installation folder, so updates fail. Sparkle gets around this by running the updater outside the app sandbox. https://sparkle-project.org/documentation/sandboxing/

Reproduction

Build a sandboxed app and try running the updater.

My entitlements file is as follows:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>

    <key>com.apple.security.files.user-selected.read-write</key>
    <true/>

    <key>com.apple.security.network.client</key>
    <true/>
</dict>
</plist>

Expected behavior

There should be a way to auto-update with sandbox enabled.

Platform and versions

[✔] Environment
    - OS: Mac OS 14.1.0 X64
    ✔ Xcode Command Line Tools: installed
    ✔ rustc: 1.73.0 (cc66ad468 2023-10-03)
    ✔ cargo: 1.73.0 (9c4383fb5 2023-08-26)
    ✔ rustup: 1.26.0 (5af9b9484 2023-04-05)
    ✔ Rust toolchain: stable-aarch64-apple-darwin (default)
    - node: 20.6.1
    - pnpm: 8.6.3
    - yarn: 3.4.1
    - npm: 9.8.1
    - bun: 1.0.0

[-] Packages
    - tauri [RUST]: 1.5.2
    - tauri-build [RUST]: 1.5.0
    - wry [RUST]: 0.24.4
    - tao [RUST]: 0.16.5
    - @tauri-apps/api [NPM]: 1.5.1
    - @tauri-apps/cli [NPM]: 1.5.6

[-] App
    - build-type: bundle
    - CSP: unset
    - distDir: ../dist
    - devPath: http://localhost:1420/
    - framework: React
    - bundler: Vite

### Stack trace

```text
The following is the error event emitted by the updater:


Tauri API error: Operation not permitted (os error 1)

### Additional context

_No response_