Add finalize stage, to install OS updates and the runner on snapshotted xcode images

What does this MR do?

Implements the following from https://gitlab.com/gitlab-org/ci-cd/shared-runners/macos/-/tree/master#macos-and-xcode-version-support

Again, once the first patch release (12.1) is available, the image for the previous OS (11) moves to frozen mode. We do only unavoidable changes in this mode: security updates, Xcode patches, runner version upgrades, and setting our production password.

Re-enables security updates and runner version upgrades for images before Big Sur. In a follow up MR, we should rename the runner stage to xcode (since the runner is no longer installed at this stage) and maybe finalize to runner?

Why was this MR needed?

What's the best way to test this MR?

What are the relevant issue numbers?