Restrict HRZ allowlist update service privileges

flake-module.nix

@@ -26,15 +26,14 @@
     in {
       check.enable = true;
       settings = {
-        hooks = {
+        # for some reason statix takes it config differently than all the other hooks.
-          nil.enable = true;
+        settings.statix = {
-          statix = {
-            enable = true;
-            settings = {
           format = "stderr";
           ignore = generatedFiles;
         };
-          };
+        hooks = {
+          nil.enable = true;
+          statix.enable = true;
           deadnix = {
             enable = true;
             excludes = generatedFiles;