Add Prisma Access Browser as a macOS FMA (#49641)

**Related issue:** Resolves #49328

Adds Prisma Access Browser (Homebrew cask `prisma-access-browser`) as a
macOS Fleet-maintained app.

## Notes for reviewers

**Naming/slug:** This product already ships as a Windows FMA named
**Prisma Browser** (`prisma-browser/windows`, added in #46409 — "Prisma
Browser" is Palo Alto's current branding for what was Prisma Access
Browser). The FMA library combines platforms into one row by slug token,
so this entry uses `name: "Prisma Browser"` and `slug:
"prisma-browser/darwin"` while keeping `token: "prisma-access-browser"`
for the cask lookup (same token≠slug pattern as the `libreoffice`,
`ollama`, and `zoom` inputs). Both platforms now show as a single
"Prisma Browser" library row and share the existing Prisma icon, so no
icon changes are needed.

**Identity verified against the real installer** (downloaded the full
pkg; SHA256 matches the cask):
- `CFBundleIdentifier` = `com.talon-sec.Work` (from the pkg
Distribution/PackageInfo), so the exists query matches osquery's `apps`
table.
- `CFBundleShortVersionString` = `150.49.5.129`, exactly the cask
version before the comma, so the patched query's `bundle_short_version`
comparison reconciles.
- Installs `Prisma Access Browser.app` machine-wide to `/Applications`
as root; requires macOS 12+. Not a bootstrapper.

**Install script filename:** the cask's pkg artifact
(`PrismaBrowser-universal.pkg`) doesn't match the URL basename, but the
vendor serves that name via `Content-Disposition`, which is what the
server stores (`FilenameFromResponse`) and what orbit names the
downloaded installer on both download paths — so the auto-generated
install script works without a custom script.

**Installer URL** is pinned (version + hash in the path), so no
latest-redirect SHA-drift risk.

# Checklist for submitter

## Testing

- [x] Verified installer identity fields (bundle ID, versions, SHA256)
against the real pkg
- [x] `go test ./ee/maintained-apps/... ./cmd/maintained-apps/...`
passes; generated JSON validated
- [ ] FMA validator run (CI) confirms install/uninstall on a macOS host

ee/maintained-apps/inputs/homebrew/prisma-browser.json

@@ -0,0 +1,8 @@
+{
+  "name": "Prisma Browser",
+  "slug": "prisma-browser/darwin",
+  "unique_identifier": "com.talon-sec.Work",
+  "token": "prisma-access-browser",
+  "installer_format": "pkg",
+  "default_categories": ["Browsers"]
+}

ee/maintained-apps/outputs/apps.json

@@ -6602,6 +6602,13 @@
       "unique_identifier": "com.GraphPad.Prism.autocomplete",
       "description": "GraphPad Prism is a statistical analysis and graphing software."
     },
+    {
+      "name": "Prisma Browser",
+      "slug": "prisma-browser/darwin",
+      "platform": "darwin",
+      "unique_identifier": "com.talon-sec.Work",
+      "description": "Prisma Browser is a SASE-native browser that empowers secure work."
+    },
     {
       "name": "Prisma Browser",
       "slug": "prisma-browser/windows",