docs: sign macOS profiles with CMS, and scope the iOS claims properly

Three review findings, all correct.

`productsign` signs installer packages, not configuration profiles, and
an Apple Developer ID certificate cannot sign a profile at all — Apple's
own guidance is that a `.mobileconfig` is a CMS signed-data message. The
instruction predates this branch but the commit that fixed the malformed
XML comment rewrote it, so it is fixed here rather than carried forward.
It was also misleading in a second way: a profile delivered through an
MDM is signed by the MDM channel, so a managed rollout has nothing to
sign by hand. The step now says that, and gives `security cms -S` for the
case where the profile is handed out some other way.

"Every key is enforced on iOS" contradicted the list of
platform-inapplicable keys three paragraphs below it; it now reads "every
key that applies to the platform", and points at that list.

The engine-applied group — blockInbound, wireguardPort, lazyConnection,
allowRemoteJobs, debugBundleUploadURL — was stated without qualification
under a table headed "iOS / tvOS", while the warning just above says the
tvOS engine never receives the policy. Marked as iOS, with the tvOS case
pointed back at that warning.

public/docs-static/files/netbird-macos.mobileconfig

@@ -16,10 +16,16 @@
         (confirm against the signed pkg before fleet roll-out)
 
     Distribution:
-      - sign with `productsign`, passing your "Developer ID Installer"
-        certificate to its sign flag,
-        before fleet roll-out (Apple-Configurator-2 won't install an
-        unsigned profile on Sonoma+ without user override).
+      - delivered through an MDM, the profile is signed by the MDM
+        channel itself; nothing to sign by hand,
+      - handed out any other way (Apple Configurator, double-click), it
+        installs unsigned and asks the user to confirm on recent macOS.
+        To avoid that, sign it as a CMS message with an identity the
+        target Macs trust:
+            security cms -S -N "Your Signing Identity" \
+                         -i netbird-macos.mobileconfig -o signed.mobileconfig
+        Configuration profiles are not signed with productsign, which
+        handles installer packages.
       - For local dev install: `sudo profiles install -path netbird-macos.mobileconfig`.
       - For MDM (Jamf/Kandji/Mosyle/Intune): upload as a Custom Profile.