When there exists an iCloud keychain, notarytool by default uses that.
The iCloud keychain does not have a local path, and thus cannot be
specified explicitly using --keychain, only implicitly using no
--keychain argument.

Make the opts.keychain argument optional, to allow this (common)
behavior.

Co-authored-by: Jon Watte <[email protected]>