Use ditto vs zip to ensure symlink preservation and maybe other things I missed

.ci/macos/notarize.sh

@@ -22,8 +22,6 @@ if [ "${CI_PIPELINE_TRIGGERED}" ]; then
   # so move it to the right place for the rest of the process.
   ( cd build || exit
     unzip nheko.zip
-    mv build/nheko.app .
-    rm -rf build
   )
 fi
 

.cirrus.yml

@@ -11,7 +11,7 @@ task:
     - export PATH="$(brew --prefix qt5)/bin/:${PATH}"
     - ./.ci/macos/build.sh
   zip_script:
-    - zip -r build/nheko.zip build/nheko.app
+    - ditto -c -k --sequesterRsrc --keepParent build/nheko.app build/nheko.zip
   gitlab_script:
     - curl -X POST
         --fail