doas: add NixOS binary dirs to safe PATH

[cole-h]

I recently tried to give myself passwordless doas for virsh commands
(starting, stopping, and editing VMs), but doas was complaining that
it didn't know what virsh was.

This patch adds /run/current-system/sw/{s,}bin and /run/wrappers/bin
to the safe path, allowing system binaries to be discovered and executed
properly.

Motivation for this change

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

---

A draft because I'd like to know: should I also add /run/wrappers/bin to the safe path?

EDIT: discussed with @emilazy on IRC, and we determined it should be added (it has things like ping!)

EDIT2: We also discussed removing the FHS paths, but it doesn't hurt to keep them in... Additionally, somebody might be using doas on non-NixOS (for whatever reason) or in a buildFHSEnv (I don't actually know if that's possible but I don't have the desire to test it).