nixos/locate: remove bash wrapper from systemd

There's a few reasons this is useful:

- it makes it easier to override the unit temporarily with, say,
  `systemctl edit --runtime update-locatedb.service` because you can see
  the actual command that's in use -- this was my initial motivation
- it removes an unnecessary layer of indirection when systemd executes
  the updatedb command
- it permits using locate with a bashless image
- not strictly necessary -- we could have done this with the bash script
  as well -- but the change is a chance to make sure every argument is
  properly escaped

In passing, update the type for the `services.locate.output` to
`externalPath`.  This prevents specifying a path in the Nix store to
house the locate database, since updatedb is never going to be able to
rewrite the database when running as a systemd unit.  We could revert
this if we somehow find a way and a use case for having the database
created while building a NixOS image, but that seems unlikely to me.

Co-authored-by: SandaruKasa <SandaruKasa@ya.ru>

nixos/modules/misc/locate.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  utils,
   pkgs,
   ...
 }:
@@ -59,7 +60,7 @@ in
     };
 
     output = lib.mkOption {
-      type = lib.types.path;
+      type = lib.types.externalPath;
       default = "/var/cache/locatedb";
       description = ''
         The database file to build.
@@ -249,27 +250,35 @@ in
     systemd.services.update-locatedb = {
       description = "Update Locate Database";
 
-      # mlocate's updatedb takes flags via a configuration file or
-      # on the command line, but not by environment variable.
-      script =
-        let
-          toFlags =
-            x: lib.optional (cfg.${x} != [ ]) "--${lib.toLower x} '${lib.concatStringsSep " " cfg.${x}}'";
-          args = lib.concatLists (
-            map toFlags [
+      serviceConfig = {
+        # mlocate's updatedb takes flags via a configuration file or
+        # on the command line, but not by environment variable.
+        ExecStart =
+          let
+            toFlags =
+              x:
+              lib.optionals (cfg.${x} != [ ]) [
+                "--${lib.toLower x}"
+                (lib.concatStringsSep " " cfg.${x})
+              ];
+            args = lib.concatMap toFlags [
               "pruneFS"
               "pruneNames"
               "prunePaths"
+            ];
+          in
+          utils.escapeSystemdExecArgs (
+            [
+              (lib.getExe' cfg.package "updatedb")
+              "--output"
+              cfg.output
+              "--prune-bind-mounts"
+              (lib.boolToYesNo cfg.pruneBindMounts)
             ]
+            ++ args
+            ++ cfg.extraFlags
           );
-        in
-        ''
-          exec ${cfg.package}/bin/updatedb \
-            --output ${toString cfg.output} ${lib.concatStringsSep " " args} \
-            --prune-bind-mounts ${lib.boolToYesNo cfg.pruneBindMounts} \
-            ${lib.concatStringsSep " " cfg.extraFlags}
-        '';
-      serviceConfig = {
+
         CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_CHOWN";
         Nice = 19;
         IOSchedulingClass = "idle";