firefox: support for PKCS#11 modules in wrapper

[chvp]

Motivation for this change

Configuring the middleware for the Belgian eID in firefox required some manual work, that still left the PKCS#11 in a weird state since (at least on my machines) the firefox extension sends a notification warning about the PKCS#11 module being missing (even though the functionality worked). This adds an extra option similar to extraNativeMessagingHosts (added in #31572) that allows configuring PKCS#11 modules in the firefox wrapper. This fixed all papercuts related to the eID middleware (manually adding it is no longer required and there is no longer a notification on startup).

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[chvp]

@edolstra @andir As far as I can tell you're the Firefox maintainers. Would you mind taking a look at this?

[vcunat]

Some pkcs11 changes appear to be happening in #91746.

[chvp]

Some pkcs11 changes appear to be happening in #91746.

I don't expect that this will impact the firefox functionality, but I'd be willing to check everything again once the nss and firefox updates hit unstable.

[vcunat]

The NSS update is in master now (and most binaries are available already). If it (still) works for you, I see no reason to wait with merging it.

[chvp]

The NSS update is in master now (and most binaries are available already). If it (still) works for you, I see no reason to wait with merging it.

Still works (both on a clean firefox profile and my usual firefox profile).