Bug 1562756 - Code Injection in Firefox macOS desktop r=spohl

Drop the com.apple.security.cs.allow-dyld-environment-variables entitlement to disallow use of dyld environment variables in signed production builds.

Leave the entitlement in for signed developer builds.

Firefox gtests depend on the use of DYLD_LIBRARY_PATH. However, testing infrastructure does not run gtests on signed builds and therefore gtests are not impacted by this change. gtests could be run on signed developer builds in the future which will still allow dyld environment variables after this change.

browser.production.entitlements.xml and plugin-container.production.entitlements.xml are not used, but being kept up to date.

Differential Revision: https://phabricator.services.mozilla.com/D148324

ipc/glue/GeckoChildProcessHost.cpp

@@ -1128,6 +1128,10 @@ bool PosixProcessLauncher::DoSetup() {
     mLaunchOptions->env_map["LD_LIBRARY_PATH"] = new_ld_lib_path.get();
 
 #  elif OS_MACOSX  // defined(OS_LINUX) || defined(OS_BSD)
+    // With signed production Mac builds, the dynamic linker (dyld) will
+    // ignore dyld environment variables preventing the use of variables
+    // such as DYLD_LIBRARY_PATH and DYLD_INSERT_LIBRARIES.
+
     // If we're running with gtests, add the gtest XUL ahead of normal XUL on
     // the DYLD_LIBRARY_PATH so that plugin-container.app loads it instead.
     nsCString new_dyld_lib_path(path.get());