Motivation for this change

The hardened kernels were using backported patches, but the upstream patches for the kernel versions we're using are now out.

Also includes some refactoring of the update script including use of pathlib and type annotations (requires a local branch of the git version of PyGithub to pass mypy --strict, will work on upstreaming that).

@GrahamcOfBorg test hardened latestKernel.hardened

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.