build: Add codesigning target

Running `make` twice currently ends with an error:

```
% make
[...]
% make
CGO_ENABLED=1 CGO_CFLAGS=-mmacosx-version-min=11.0 GOOS=darwin GOARCH=amd64 go build -o out/vfkit-amd64 ./cmd/vfkit
codesign --entitlements vf.entitlements -s - out/vfkit-amd64
out/vfkit-amd64: is already signed
make: *** [out/vfkit-amd64] Error 1
```

This commit moves codesigning to its own target, and makes use of
'stamp' files to detect when codesigning needs to be redone.

Makefile

@@ -13,14 +13,20 @@ test: build
 	@go test ./pkg/... ./test
 
 clean:
+	rm codesign-{amd64,arm64}-stamp
 	rm -rf out
 
 out/vfkit-amd64 out/vfkit-arm64: out/vfkit-%: force-build
 	@mkdir -p $(@D)
 	CGO_ENABLED=1 CGO_CFLAGS=$(CGO_CFLAGS) GOOS=darwin GOARCH=$* go build -o $@ ./cmd/vfkit
 	codesign -f --entitlements vf.entitlements -s - $@
 
-out/vfkit: out/vfkit-amd64 out/vfkit-arm64
+codesign-amd64-stamp codesign-arm64-stamp: codesign-%-stamp: out/vfkit-%
+	codesign -f --entitlements vf.entitlements -s - $<
+	touch $@
+
+
+out/vfkit: codesign-amd64-stamp codesign-arm64-stamp
 	cd $(@D) && lipo -create $(^F) -output $(@F)
 
 # the go compiler is doing a good job at not rebuilding unchanged files