hst: check for insecure PulseAudio enablement

This is currently still a noop, but required for #26.

Signed-off-by: Ophestra <cat@gensokyo.uk>

options.nix

@@ -218,7 +218,7 @@ in
                   type = nullOr bool;
                   default = true;
                   description = ''
-                    Whether to share the Wayland socket.
+                    Whether to share the Wayland server via security-context-v1.
                   '';
                 };
 
@@ -238,11 +238,19 @@ in
                   '';
                 };
 
+                pipewire = mkOption {
+                  type = nullOr bool;
+                  default = true;
+                  description = ''
+                    Whether to share the PipeWire server via SecurityContext.
+                  '';
+                };
+
                 pulse = mkOption {
                   type = nullOr bool;
                   default = true;
                   description = ''
-                    Whether to share the PulseAudio socket and cookie.
+                    Whether to run the PulseAudio compatibility daemon.
                   '';
                 };
               };