Run notarization earlier in the build process

We currently run notarization as part of the push task, but this can't be patch built. It also means that the files on the task download page from things like the package task aren't notarized, even though they could be. We should consider moving notarization from push into package to improve its testability, and to ensure that binaries pulled from the package task are of the same quality as those we would publish to the world.