nixos/wyoming-piper: allow w+x for onnxruntime (#402111)

Before this change, running piper would fail with

> cannot enable executable stack as shared object requires

because the stack is marked rwx on newer libonnxruntime versions.

Changed files
+1 -1
nixos
modules
services
home-automation
wyoming
+1 -1
nixos/modules/services/home-automation/wyoming/piper.nix
···
DeviceAllow = "";
DevicePolicy = "closed";
LockPersonality = true;
-
MemoryDenyWriteExecute = true;
+
MemoryDenyWriteExecute = false; # required for onnxruntime
PrivateDevices = true;
PrivateUsers = true;
ProtectHome = true;