xdg-autostart: Add readOnly option

[olmokramer]

Description

Some programs add a .desktop file to XDG_CONFIG_HOME/autostart when they are started (can't remember from the top of my head which program did for me, and I've already deleted the file), but I want to be able to explicitly grant programs permission to autostart in my home manager configuration. This PR adds a xdg.autostart.readOnly option to make that possible.

When readOnly is set to true the autostart entries are linked from a readonly directory in the nix store and XDG_CONFIG_HOME/autostart is a link to that directory, so that programs cannot install arbitrary autostart services.

I haven't added a test yet because I first wanted to check whether this has a chance of being merged and if we really need the readOnly option, or if we should just always make XDG_CONFIG_HOME/autostart readonly, because something similar was done without an option for backwards compatibility in #5553.

Checklist

• Change is backwards compatible.

• Code formatted with ./format.

• Code tested through nix-shell --pure tests -A run.all
  or nix build --reference-lock-file flake.lock ./tests#test-all using Flakes.

• Test cases updated/added. See example.

• Commit messages are formatted like

  {component}: {description}
  
  {long description}
  

  See CONTRIBUTING for more information and recent commit messages for examples.

• If this PR adds a new module

  • Added myself as module maintainer. See example.

Maintainer CC @Scrumplex

[Scrumplex]

Using the recursive option for HM's file options would be cleaner, I think. Recursive = true would link all files inside source recursively, whereas recursive = false would link autostart directly to source.

This also allows us to remove mapDesktopEntry above.

Suggested change

	xdg.configFile = if cfg.readOnly then {
	autostart.source = linkedDesktopEntries;
	} else
	listToAttrs (map mapDesktopEntry cfg.entries);
	xdg.configFile."autostart" = {
	recursive = !cfg.readOnly;
	source = linkedDesktopEntries;
	};