Restrict HRZ allowlist update service privileges

flake-module.nix

@@ -26,15 +26,14 @@
     in {
       check.enable = true;
       settings = {
+        # for some reason statix takes it config differently than all the other hooks.
+        settings.statix = {
+          format = "stderr";
+          ignore = generatedFiles;
+        };
         hooks = {
           nil.enable = true;
-          statix = {
+          statix.enable = true;
-            enable = true;
-            settings = {
-              format = "stderr";
-              ignore = generatedFiles;
-            };
-          };
           deadnix = {
             enable = true;
             excludes = generatedFiles;