Unity script to run a post-build process that adds some keys to Info.plist and some capabilities to the entitlements file.

XcodeBuildScript.cs

using System;
using System.IO;
using JetBrains.Annotations;
using UnityEditor;
using UnityEditor.Callbacks;
using UnityEditor.iOS.Xcode;
using UnityEngine;

/** See Also:
    - https://github.com/Mazyod/Unity-AutoBuilder
    - https://forum.unity.com/threads/problem-configuring-pbx-project-in-osx.1058522/
 */
public class XcodeBuildScript : ScriptableObject
{
    // hold the path to entitlements file
    public DefaultAsset macosEntitlementsFile;

    [PostProcessBuild, UsedImplicitly]
    public static void OnPostprocessBuild(BuildTarget buildTarget, string targetPath)
    {
        // only run for iOS, macOS (add more as needed, e.g. tvOS)
        if (buildTarget != BuildTarget.iOS && buildTarget != BuildTarget.StandaloneOSX)
        {
            return;
        }

        // grab the product name from player settings, will be useful to determine paths for macOS
        var targetName = buildTarget switch
        {
            BuildTarget.iOS => "Unity-iPhone",
            BuildTarget.StandaloneOSX => PlayerSettings.productName,
            _ => throw new ArgumentOutOfRangeException(nameof(buildTarget), buildTarget, null)
        };

        // update info.plist file
        var fullTargetPath = Path.GetFullPath(targetPath);
        var document = new PlistDocument();
        var infoPlistPath = Path.Combine(fullTargetPath, targetName, "info.plist");
        document.ReadFromFile(infoPlistPath);

        var plist = document.root;
        plist.SetBoolean("ITSAppUsesNonExemptEncryption", false);

        document.WriteToFile(infoPlistPath);

        // here, we modify the Xcode pbx project file to add the following capabilities:
        // 1. In-App Purchase
        // 2. Hardened Runtime (aka sandbox)
        // that's it!

        // get the pbx project
        var dirname = Path.GetFileName(fullTargetPath);
        var projectPath = Path.Combine(fullTargetPath, $"{dirname}.xcodeproj/project.pbxproj");
        var project = new PBXProject();
        project.ReadFromFile(projectPath);

        var mainTargetGuid = project.TargetGuidByName(targetName);
        var targetGuids = new[] {mainTargetGuid};
        // TODO: this one too for iOS?
        // project.GetUnityFrameworkTargetGuid()
        project.SetBuildProperty(targetGuids, "ENABLE_BITCODE", "NO");

        project.AddCapability(mainTargetGuid, PBXCapabilityType.InAppPurchase);
        // project.AddCapability(mainTargetGuid, PBXCapabilityType.PushNotifications, entitlementPath);
        // TODO: perhaps add apple sign in later

        // prepare entitlements file
        // TODO: support iOS
        if (buildTarget != BuildTarget.StandaloneOSX)
        {
            return;
        }

        // This class is a scriptable object, so we can assign the entitlements file path to it
        // to access the entitlements filepath, we instantiate a dummy object
        var dummy = CreateInstance<XcodeBuildScript>();
        var entitlementsFile = dummy.macosEntitlementsFile;
        DestroyImmediate(dummy);

        var entitlementsSourcePath = AssetDatabase.GetAssetPath(entitlementsFile);
        var entitlementsFileName = $"{targetName}.entitlements";
        var entitlementsRelativePath = Path.Combine(targetName, entitlementsFileName);
        // copy entitlements file to the target path
        var entitlementsTargetPath = Path.Combine(fullTargetPath, entitlementsRelativePath);
        File.Copy(entitlementsSourcePath, entitlementsTargetPath);
        // add it to the project
        project.AddFile(entitlementsTargetPath, entitlementsRelativePath);
        project.SetBuildProperty(mainTargetGuid, "CODE_SIGN_ENTITLEMENTS", entitlementsRelativePath);
        
        // write the pbx project back to the file
        project.WriteToFile(projectPath);
    }
}