security.wrappers: copy source programs instead of wrapping in binaries

Copying the wrapper code from NixOS and hoping that I managed to catch
all the relevant dyld environment variables was not particularly
confidence-inducing, so this commit removes the wrappers entirely and
simply copies the source programs before modifying permissions. This
means that the given source programs must safely handle being
setuid/setgid binaries and being located in `/run/wrappers/bin`.

There's now only `default.nix` in `modules/security/wrappers`, so I
could have removed the directory, but I have left it for now in
anticipation of other files potentially ending up there.

modules/security/wrappers/default.nix

@@ -52,10 +52,6 @@ let
       (opts: mkWrapper opts)
       (builtins.attrValues cfg.wrappers);
 
-  securityWrapper = sourceProg : pkgs.pkgsStatic.callPackage ./wrapper.nix {
-    inherit sourceProg;
-  };
-
   mkWrapper =
     { program
     , source
@@ -71,10 +67,10 @@ let
       codesigned = if codesign
         then ''
           # codesign ${source} to "$wrapperDir/${program}" INSTEAD OF the next line
-          cp ${securityWrapper source}/bin/security-wrapper "$wrapperDir/${program}"
+          cp ${source} "$wrapperDir/${program}"
         ''
         else ''
-          cp ${securityWrapper source}/bin/security-wrapper "$wrapperDir/${program}"
+          cp ${source} "$wrapperDir/${program}"
         '';
     in
     ''