mkDerivation, cc-wrapper: Check hardening flag validity in Nix

This becomes necessary if more wrappers besides cc-wrapper start
supporting hardening flags. Also good to make the warning into an
error.

Also ensure interface is being used right: Not as a string, not just in
bash.

pkgs/os-specific/linux/devmem2/default.nix

@@ -8,8 +8,9 @@ stdenv.mkDerivation rec {
     sha256 = "14f1k7v6i1yaxg4xcaaf5i4aqn0yabba857zjnbg9wiymy82qf7c";
   };
 
+  hardeningDisable = [ "format" ];  # fix compile error
+
   buildCommand = ''
-    export hardeningDisable=format  # fix compile error
     cc "$src" -o devmem2
     install -D devmem2 "$out/bin/devmem2"
   '';