Python is an interpreter and therefore needs to create executable
memory. Since it doesn't know how to sign that memory it requires
the allow-unsigned-executable-memory entitlement to run in a hardened
runtime. One must apply this entitlement to both Gramps.app and
Gramps.app/Contents/MacOS/dot when codesigning them.
