treewide: Fix unsafe concatenation of $LD_LIBRARY_PATH

Naive concatenation of $LD_LIBRARY_PATH can result in an empty
colon-delimited segment; this tells glibc to load libraries from the
current directory, which is definitely wrong, and may be a security
vulnerability if the current directory is untrusted.  (See #67234, for
example.)  Fix this throughout the tree.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>

pkgs/tools/X11/primus/default.nix

@@ -27,7 +27,7 @@ let
 
 in writeScriptBin "primusrun" ''
   #!${runtimeShell}
-  export LD_LIBRARY_PATH=${ldPath}:$LD_LIBRARY_PATH
+  export LD_LIBRARY_PATH=${ldPath}''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
   # https://bugs.launchpad.net/ubuntu/+source/bumblebee/+bug/1758243
   export __GLVND_DISALLOW_PATCHING=1
   exec "$@"