nodejs: fix checkPhase with sandbox=relaxed on Darwin

The following tests fail on Darwin with the sandbox enabled [1]:

not ok 2612 parallel/test-runner-output
not ok 3053 parallel/test-tls-get-ca-certificates-system
not ok 3054 parallel/test-tls-get-ca-certificates-system-without-flag
not ok 3363 parallel/test-watch-file-shared-dependency
not ok 4057 parallel/test-runner-complex-dependencies
not ok 4058 parallel/test-runner-global-setup-watch-mode
not ok 4228 sequential/test-watch-mode-watch-flags

Node.js uses Security.framework to read the system CA certificates from
the system keychain on Darwin. Fix the tls-get-ca-certificates-system
tests by adding the files and Mach services used by Security.framework
to the sandbox profile. Also allow the FSEvents Mach service as the
runner and watch tests use FSEvents on Darwin.

[1]: https://gist.github.com/al3xtjames/0eb3c30d37c1ebab99968c62ee544300

pkgs/development/web/nodejs/nodejs.nix

@@ -427,6 +427,27 @@ let
         }"
       ];
 
+      sandboxProfile = ''
+        (allow file-read*
+          (literal "/Library/Keychains/System.keychain")
+          (literal "/private/var/db/mds/system/mdsDirectory.db")
+          (literal "/private/var/db/mds/system/mdsObject.db"))
+
+        ; Allow files written by Module Directory Services (MDS), which is used
+        ; by Security.framework: https://apple.stackexchange.com/a/411476
+        ; These rules are based on the system sandbox profiles found in
+        ; /System/Library/Sandbox/Profiles.
+        (allow file-write*
+          (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsDirectory\.db$")
+          (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsObject\.db_?$")
+          (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mds\.lock$"))
+
+        (allow mach-lookup
+          (global-name "com.apple.FSEvents")
+          (global-name "com.apple.SecurityServer")
+          (global-name "com.apple.system.opendirectoryd.membership"))
+      '';
+
       postInstall =
         let
           # nodejs_18 does not have node_js2c, and we don't want to rebuild the other ones