internal/outcome: expose pipewire via pipewire-pulse

This no longer exposes the pipewire socket to the container, and instead mediates access via pipewire-pulse. This makes insecure parts of the protocol inaccessible as explained in the doc comment in hst.

Closes #29.

Signed-off-by: Ophestra <cat@gensokyo.uk>

nixos.nix

@@ -196,15 +196,6 @@ in
                             }
                           ]
                         )
-                        ++ optional (app.enablements.pipewire && app.pulse) {
-                          type = "daemon";
-                          dst = if app.mapRealUid then "/run/user/${toString config.users.users.${username}.uid}/pulse/native" else "/run/user/65534/pulse/native";
-                          path = cfg.shell;
-                          args = [
-                            "-lc"
-                            "exec pipewire-pulse"
-                          ];
-                        }
                         ++ [
                           {
                             type = "bind";