Since macOS 12.0 deprecated the tools needed to attach a SLA to a `.dmg`, we should no longer do this by default. Add a policy to change the default to off. Fixes: #22978