Python: add setupHook for deterministic build of .pyc in dependents

[FRidh]

Issue description

The Python interpreters are patched so they can build .pyc bytecode free of certain indeterminism.
When building Python packages we currently set

  # Determinism: The interpreter is patched to write null timestamps when compiling python files.
  # This way python doesn't try to update them when we freeze timestamps in nix store.
  DETERMINISTIC_BUILD=1;
  # Determinism: We fix the hashes of str, bytes and datetime objects.
  PYTHONHASHSEED = 0;

Instead of keeping it just in this function, I propose that we move this to the setupHook of the interpreters.

cc @domenkozar @Mic92 @abbradar @bennofs @lsix and whoever I forgot to whom this may be relevant.

[domenkozar]

AFAIK this turns off hashdos attack protection

[nh2]

Is it not possible to turn (the equivalent of) PYTHONHASHSEED only for interface file generation?

If not, I imagine it shouln't be too hard to add that to upstream python, or patch this functionality in (but I assume a lot of people would like it)?

[FRidh]

Randomization is only turned off when building packages. Afterwards, this reproducible .pyc is used but the algorithms should then start doing randomization, not already during build-time.

[FRidh]

Relevant issue on Python bug tracker: http://bugs.python.org/issue13703

[FRidh]

I asked on Python-Dev and was told that we won't have to worry about the hash DOS attack.
https://mail.python.org/pipermail/python-dev/2017-May/147935.html

[FRidh]

The setupHook is of course also ran when using Python in a nix-shell and thus also when using nix-shell as shebang. If anyone runs a server from a script running through nix-shell, then that server will be at risk. That will have to be documented.

[FRidh]

Closing because this is merged in staging (#25916).