Merge a subset of staging (security)

In particular, this contains Firefox-related and libgcrypt updates.
Other larger rebuilds would apparently need lots of time to catch up
on Hydra, due to nontrivial rebuilds in other branches than staging.

pkgs/build-support/cc-wrapper/setup-hook.sh

@@ -68,7 +68,7 @@ set -u
 ccWrapper_addCVars () {
     # See ../setup-hooks/role.bash
     local role_post role_pre
-    getTargetRoleEnvHook
+    getHostRoleEnvHook
 
     if [[ -d "$1/include" ]]; then
         export NIX_${role_pre}CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include"