lix: link with -z,noexecstack

Defense-in-depth so a dependency cannot give lix an executable stack,
like libucontext did.

Signed-off-by: Raito Bezarius <masterancpp@gmail.com>

pkgs/tools/package-management/lix/common-lix.nix

@@ -287,6 +287,10 @@ stdenv.mkDerivation (finalAttrs: {
         "${finalAttrs.cargoDeps}/source-registry-0"
       else
         "lix: no `MESON_PACKAGE_CACHE_DIR`, set `cargoDeps`";
+
+    # Defense-in-depth: never inherit an executable stack from a dependency.
+    # It does happen: https://github.com/NixOS/nixpkgs/issues/567777.
+    NIX_LDFLAGS = "-z,noexecstack";
   };
 
   propagatedBuildInputs = [