Fix/ios cert secret guard - #545

The first run of this step died on

    base64: stdin: (null): error decoding base64 input stream
    Error: Process completed with exit code 1

which names neither the secret nor the mistake, in a step whose whole job
is to stop a signing problem from being cryptic.

The value was a *path* rather than the file's contents. I could not find
any other input that produces that message: empty, wrapped lines, stray
spaces and even a PEM header all decode without complaint on macOS, so the
one thing it does say is the one thing it says badly.

So the decode is guarded and its result is checked. Whitespace is stripped
first, because a value that travelled through a browser text field arrives
with whatever that field did to it, and `base64 --decode` is not uniformly
forgiving about it across runner images. Then the bytes have to start 0x30,
the DER SEQUENCE tag — a .cer, a PEM or a truncated paste all reach
`security import` otherwise, and it answers "Unknown format in import",
which is the same problem one layer further down.