nixos/polkit: remove SUID wrapper for polkit-agent-helper-1

Polkit v127 no longer requires a SUID `polkit-agent-helper-1` and instead
recommends using a socket-activated `polkit-agent-helper` service[1].

[1] <https://github.com/polkit-org/polkit/pull/501>

nixos/modules/security/polkit.nix

@@ -78,6 +78,8 @@ in
     ];
     systemd.services.polkit.stopIfChanged = false;
 
+    systemd.sockets."polkit-agent-helper".wantedBy = [ "sockets.target" ];
+
     # The polkit daemon reads action/rule files
     environment.pathsToLink = [ "/share/polkit-1" ];
 
@@ -94,19 +96,11 @@ in
 
     security.pam.services.polkit-1 = { };
 
-    security.wrappers = {
-      pkexec = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${cfg.package.bin}/bin/pkexec";
-      };
-      polkit-agent-helper-1 = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${cfg.package.out}/lib/polkit-1/polkit-agent-helper-1";
-      };
+    security.wrappers.pkexec = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${cfg.package.bin}/bin/pkexec";
     };
 
     systemd.tmpfiles.rules = [