Notarize all macOS builds except PRs

[Jojo-Schmitz]

and not just nightly builds

I understand that for PRs this is not going to happen for security reasons, but for pushes it should be as save as for nightly builds.

[cbjeukendrup]

For us, this shouldn't make a different right? Because we don't build on push events.

Also, it looks like Apple won't be particularly happy when people push a lot of useless builds to their notarisation servers (https://developer.apple.com/forums/thread/124958, see the post by "DTS Engineer"). Of course, there will never be incredibly many pushes per day, so I'm not really against this PR, but it is something to keep in mind. There is a kind of rate limit of 75 notarisations per day. Worst case scenario is that they somehow detect something as abuse and end your developer account, but that won't happen very soon I think.

[Jojo-Schmitz]

Oh, I wasn't aware that you don't build on push events.
But as long as it doesn't impose any danger, I'd rather enable it for my 3.x, as it eases the testing.