Downloader XPC Service needs changes to avoid Sonoma sandboxing warning prompts

[zorgiepoo]

If multiple apps use the sandboxed Downloader XPC Service (in any version of Sparkle 2), there is a chance users will encounter a one-time warning about one app's downloader service differing from a previously launched downloader service from another app because they both use the same sandbox container, on macOS 14 (Sonoma) or later.

There are a couple a ways to resolve this that I can think of.

1. Developers should use a custom bundle ID for the downloader service -- this is not convenient/practical when using pre-built versions of Sparkle including from package managers.
2. We stop sandboxing this service, at least by default, and change the bundle ID.

[zorgiepoo]

Landed in 2.6.0-beta.1. The Downloader XPC Service is now not sandboxed by default which will prevent these types of warnings that macOS Sonoma introduced (when multiple sandboxed apps access the same sandbox container). The sandboxing documentation has been updated.

[zorgiepoo]

Sample screenshot of the issue:

[zorgiepoo]

For reference these are the repro steps for the system warning to show up on macOS 14 and later:

1. rm -rf ~/Library/Containers/org.sparkle-project.Downloader so we can trigger the first-time prompt of a specific app accessing this sandbox container.
2. Launch one affected Sparkle based app that enables the downloader XPC Service with a non-custom XPC Service bundle ID. Have the app check for updates and create the above directory we removed in step 1. (E.g. try with Keka 1.3.7)
3. Launch another affected Sparkle based app that meets the criteria in step 2, but is signed with a different Team ID than in step 2. Have the app check for updates. (E.g. try with HandBrake 1.7.3)