wrapPythonPrograms: do not propagate disabling user site-packages to child-processes

The `PYTHONNOUSERSITE` was exported to prevent impurities during
runtime. The downside of exporting environment variables is that they
always propagate all the way down the process tree, unless they are
explicitly unset at some point. Using the `-s` argument applies it only
to the process executed in the wrapper. That way, subprocesses are free
to do impure things.

pkgs/development/interpreters/python/wrap.sh

@@ -67,7 +67,7 @@ wrapPythonProgramsIn() {
                     # (see pkgs/build-support/setup-hooks/make-wrapper.sh)
                     local -a wrap_args=("$f"
                                     --prefix PATH ':' "$program_PATH"
-                                    --set PYTHONNOUSERSITE "true"
+                                    --add-flags '-s'
                                     )
 
                     # Add any additional arguments provided by makeWrapperArgs