Security updates

A security update fixes a known hole (a CVE) in a package. People run the old, weak version until it merges, so these come first. The oldest wait is on top of each group. Press Review one to open the update that waited longest, and read its checklist. The NixOS security tracker shows which CVEs affect which packages.