fix: issue-12 Fix for missing system permissions @ macOS

[infrat]

Summary

On macOS 10.14+ all audio input, including sound-card SDR sources like the QMX/QDX
IQ stream, is gated behind the microphone (TCC) permission. Without it a HAL input
unit still opens and starts, but AudioUnitRender only ever returns silence, so the
waterfall stays empty and no error is shown. This PR makes the app request the
permission properly and fail loudly when it is denied.

Changes

• Microphone permission handling (MacOSPermissions.h/.mm): new helper that
  queries/requests audio-input authorization via AVCaptureDevice. Presents the
  system consent prompt on first run and blocks until the user responds (120s
  timeout). Reports Granted on pre-10.14 where audio input isn't TCC-gated.
• QMX backend (MacOSBackend.cpp): checks/obtains microphone consent before
  opening the capture device and returns clear, actionable errors on
  Denied/Restricted/NotDetermined instead of silently streaming zeros.
• Bundle metadata (bundle_utils.sh): adds NSMicrophoneUsageDescription to
  Info.plist so macOS can actually show the consent prompt.
• Code signing (bundle_utils.sh, stage_macos_bundle.sh, sdrpp.entitlements):
  signs with the hardened runtime and the com.apple.security.device.audio-input
  entitlement so TCC honors the request. Adds disable-library-validation so the
  bundled ad-hoc-signed third-party dylibs still load. Falls back to the previous
  plain ad-hoc signature when no entitlements file is passed.
• Build (libqmx/CMakeLists.txt): compiles the .mm helper and links
  AVFoundation on Apple platforms only.

Testing

• Built and staged the macOS bundle; verified the microphone consent prompt appears
  on first stream start and that granting it produces a live waterfall from the QMX.
• Confirmed a clear error is surfaced (instead of an empty waterfall) when access is
  denied.

Fixes #12