sonarr: init at 2.0.0.4146 + sonarr service

As pointed out by @danbst, the tomcat NixOS module expects packages
listed in services.tomcat.webapps to either be direct .war file paths or
have .war files inside a "webapps" directory.

Commit 4075c10a
("jenkins: move .war file from $out to $out/lib/jenkins.war") broke
jenkins + tomcat. Fix it by moving jenkins.war to $out/webapps/.

The grsec patch fails to apply cleanly when combined with the hiddev CVE patch
(added in dde259df).  To fix this and future
problems, we set all our patches explicitly rather than inherit from the base
kernel.

inline-c-cpp: fix build on darwin

git: 2.9.0 -> 2.9.1

Fixes #14137, also known as:

  $ nix-shell -p jenkins
  bash: source: /nix/store/ln1yw6c2v8bb2cjqfr1z5aqcssw054wa-jenkins-2.3:
  cannot execute binary file
  [nix-shell exited with error]

The problem is that jenkins.war is not installed inside the directory
$out, but rather _as the file_ $out. Fix it by moving the file to
$out/lib/jenkins.war.

While at it, move buildCommand so that the "meta" section is at the end
of the expression (standard style), and quote shell variables.

Fix typo: s/propogate/propagate/

Fixes issue with virt-manager failing to list 'USB Host Devices' and
'PCI Host Devices' with the error "Connection does not support host
device enumeration".

This reverts commit a927709a because it
doesn't build:

$ nix-build -A openssh
...
mkdir /nix/store/yl2xap8n1by3dqxgc4rmrc4s753676a3-openssh-7.2p2/libexec
(umask 022 ; ./mkinstalldirs /var/empty)
mkdir /var
mkdir: cannot create directory '/var': Permission denied
mkdir /var/empty
mkdir: cannot create directory '/var/empty': No such file or directory
make: *** [Makefile:304: install-files] Error 1
builder for ‘/nix/store/ifygp4mqpv7l8cgp0njp8w7lmrl6brpp-openssh-7.2p2.drv’ failed with exit code 2

caddy service: fix nix store output path

secp256k1: init (native lib, and python ffi bindings at 0.12.1)

glances 2.4.2 -> 2.6.2, and dependencies

lenmus: init at 5.4.1

terraform: 0.6.15 -> 0.6.16

openssh: Use the default privilege separation dir (/var/empty)

See https://bugzilla.gnome.org/show_bug.cgi?id=764257#c12

This update was generated by hackage2nix v2.0-4-gb156b94 using the following inputs:

  - Hackage: https://github.com/commercialhaskell/all-cabal-hashes/commit/5bb0a1b20f0c9cc20c5e0c9c33deac5e855bb316
  - LTS Haskell: https://github.com/fpco/lts-haskell/commit/a5a99cf17698741e56c8efdf50989692c2e363e0
  - Stackage Nightly: https://github.com/fpco/stackage-nightly/commit/3664752ea8eaaca08dcc932bfcfaf3a3e20eddc4

systemd[11376]: caddy.service: Failed at step EXEC spawning /nix/store/ghpcwj6paccc92l1gk7ykb6gf2i2w6fi-go1.6-caddy-0.8.3/bin/caddy: No such file or directory

flashplayer: 11.2.202.626 -> 11.2.202.632 APSB16-25

If running NixOS inside a container where the host's root-owned files
and directories have been mapped to some other uid (like nobody), the
ssh daemon fails to start, producing this error message:

fatal: /nix/store/...-openssh-7.2p2/empty must be owned by root and not group or world-writable.

The reason for this is that when openssh is built, we explicitly set
`--with-privsep-path=$out/empty`. This commit removes that flag which
causes the default directory /var/empty to be used instead. Since NixOS'
activation script correctly sets up that directory, the ssh daemon now
also works within containers that have a non-root-owned nix store.

glfw: 3.1.2 -> 3.2

zerotierone: 1.1.6 -> 1.1.12

galen: 2.2.4 -> 2.3.0

eventstat: 0.02.02 -> 0.03.02

urweb: 20151220 -> 20160621

stress-ng: 0.06.01 -> 0.06.11

viber: 4.2.2.6 -> 6.0.1.5