Log warning if SIP is disabled and CLI version is < 2.15.1 (#2261)

* PR Checks: use `macos-12` runners for CLI v. < 2.15.1

Prior to CLI v2.15.1, MacOS ARM runners were not supported by the build tracer. "macos-latest" is now an ARM runner, so we run these tests on the old CLIs on Intel runners instead.

* Log a warning if SIP is disabled and CLI is < 2.15.1

* Add changenote for SIP-disabled support on old CLI versions

* Set up Python 3.11 for all MacOS checks

.github/workflows/__diagnostics-export.yml

@@ -29,7 +29,7 @@ jobs:
         include:
           - os: ubuntu-latest
             version: stable-20230403
-          - os: macos-latest
+          - os: macos-12
             version: stable-20230403
           - os: windows-latest
             version: stable-20230403
@@ -55,7 +55,7 @@ jobs:
       - name: Setup Python on MacOS
         uses: actions/setup-python@v5
         if: >-
-          matrix.os == 'macos-latest' && (
+          runner.os == 'macOS' && (
 
           matrix.version == 'stable-20230403' ||