tor-browser-bundle-bin: runtime purity improvements

These changes reduce file accesses outside TBB_HOME or the Nix store, as
determined by running under strace -e access,open,stat.

pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix

···
 # Pluggable transport dependencies
 , python27
 
+# Wrapper runtime
+, coreutils
+, glibcLocales
+, hicolor_icon_theme
+, shared_mime_info
+
 # Extra preferences
 , extraPrefs ? ""
 }:
···
 with stdenv.lib;
 
 let
-  libPath = makeLibraryPath ([
+  libPath = makeLibraryPath libPkgs;
+
+  libPkgs = [
     atk
     cairo
     dbus
···
     libXt
     pango
     stdenv.cc.cc
+    stdenv.cc.libc
     zlib
   ]
   ++ optionals pulseaudioSupport [ libpulseaudio ]
···
     gst-plugins-base
     gmp
     ffmpeg
-  ]);
+  ];
 
   gstPluginsPath = concatMapStringsSep ":" (x:
     "${x}/lib/gstreamer-0.10") [
···
     GeoIPv6File $TBB_IN_STORE/TorBrowser/Data/Tor/geoip6
     EOF
 
+    WRAPPER_XDG_DATA_DIRS=${concatMapStringsSep ":" (x: "${x}/share") [
+      hicolor_icon_theme
+      shared_mime_info
+    ]}
+
     # Generate wrapper
     mkdir -p $out/bin
     cat > "$out/bin/tor-browser" << EOF
     #! ${stdenv.shell}
     set -o errexit -o nounset
+
+    PATH=${makeBinPath [ coreutils ]}
+    export LC_ALL=C
+    export LOCALE_ARCHIVE=${glibcLocales}/lib/locale/locale-archive
 
     # Enter local state directory.
     REAL_HOME=\$HOME
···
     # Setting FONTCONFIG_FILE is required to make fontconfig read the TBB
     # fonts.conf; upstream uses FONTCONFIG_PATH, but FC_DEBUG=1024
     # indicates the system fonts.conf being used instead.
+    #
+    # XDG_DATA_DIRS is set to prevent searching system dirs (looking for .desktop & icons)
     exec env -i \
+      TZ=":" \
+      TZDIR="\''${TZDIR:-}" \
+      LOCALE_ARCHIVE="\$LOCALE_ARCHIVE" \
+      \
+      TMPDIR="\''${TMPDIR:-/tmp}" \
       HOME="\$HOME" \
       XAUTHORITY="\$XAUTHORITY" \
       DISPLAY="\$DISPLAY" \
       DBUS_SESSION_BUS_ADDRESS="\$DBUS_SESSION_BUS_ADDRESS" \
+      \
+      XDG_DATA_HOME="\$HOME/.local/share" \
+      XDG_DATA_DIRS="$WRAPPER_XDG_DATA_DIRS" \
       \
       PULSE_SERVER="\''${PULSE_SERVER:-}" \
       PULSE_COOKIE="\''${PULSE_COOKIE:-}" \