fetchpatch: support hunks option

We can pick individual hunks or ranges of hunks with filterdiff, so
expose that in fetchpatch.

This was originally useful for openssh, since the first hunks always
look like this (that is, only differing in the date):

```
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.c,v 1.616 2025/08/29 03:50:38 djm Exp $ */
+/* $OpenBSD: ssh.c,v 1.617 2025/09/04 00:29:09 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
```

The usage looks something like this to skip the first hunk in the patch.
Numbers work too, if you'd like to only pick out specific hunks.

```
fetchpatch {
  name = "my-patch";
  url = "...";
  hunks = [ "2-" ];
  hash = "...";
}
```

pkgs/build-support/fetchpatch/default.nix

@@ -17,6 +17,7 @@
   extraPrefix ? null,
   excludes ? [ ],
   includes ? [ ],
+  hunks ? [ ],
   revert ? false,
   postFetch ? "",
   nativeBuildInputs ? [ ],
@@ -90,6 +91,10 @@ lib.throwIfNot (excludes == [ ] || includes == [ ])
           -p1 \
           ${toString (map (x: "-x ${lib.escapeShellArg x}") excludes)} \
           ${toString (map (x: "-i ${lib.escapeShellArg x}") includes)} \
+          ${
+            lib.optionalString (hunks != [ ])
+              "-# ${lib.escapeShellArg (lib.concatMapStringsSep "," toString hunks)}"
+          } \
           "$tmpfile" > "$out"
 
         if [ ! -s "$out" ]; then
@@ -113,6 +118,7 @@ lib.throwIfNot (excludes == [ ] || includes == [ ])
       "extraPrefix"
       "excludes"
       "includes"
+      "hunks"
       "revert"
       "postFetch"
       "nativeBuildInputs"