Restrict HRZ allowlist update service privileges

trace: warning: The option `settings.statix' defined in `/nix/store/plj05iykqma26y930qjf75zxp2qx02sl-source/flake.nix, via option perSystem' has been renamed to `hooks.statix.settings'.

flake-module.nix

@@ -26,14 +26,15 @@
     in {
       check.enable = true;
       settings = {
-        # for some reason statix takes it config differently than all the other hooks.
-        settings.statix = {
-          format = "stderr";
-          ignore = generatedFiles;
-        };
         hooks = {
           nil.enable = true;
-          statix.enable = true;
+          statix = {
+            enable = true;
+            settings = {
+              format = "stderr";
+              ignore = generatedFiles;
+            };
+          };
           deadnix = {
             enable = true;
             excludes = generatedFiles;