Researcher who found macOS Keychain security hole is sharing details with Apple, even though company yet to promise macOS bug bounty program