nixos/podman: wrap /run/wrappers for setuid shadow binaries

adding it here so it only needs to be done once

nixos/modules/virtualisation/podman/default.nix

@@ -7,6 +7,8 @@ let
 
   podmanPackage = (pkgs.podman.override {
     extraPackages = cfg.extraPackages
+      # setuid shadow
+      ++ [ "/run/wrappers" ]
       ++ lib.optional (builtins.elem "zfs" config.boot.supportedFilesystems) config.boot.zfs.package;
   });