ld-wrapper: Put back the --sysroot filter

We still need this because some clang-based packages depend on
it. (The sysroot filtering was originally done by clang-wrapper's
ld-wrapper, but we merged the ld-wrappers in
a4f9b9c8.)

http://hydra.nixos.org/build/13906922