- instead of setting a static `PKG_KEYCHAIN_PASSWORD` secret, generate
a random password from `openssl rand` instead.
- use `PKG_APPLE_ID_EMAIL` which makes the fact it's an email a bit
more obvious. I've created this new secret already and will delete the
old one after this is merged.
- bump the latest supported version of macOS
a94ff572f7