grsecurity: ensure that PaX ELF markings are enabled

The upstream default is to enable only xattr markings, breaking the
paxmarks facility.

(cherry picked from commit a69501a936a6434fbe88fb6a0423dd425563c163)

pkgs/build-support/grsecurity/default.nix

···
         GRKERNSEC y
         ${grsecMainConfig}
 
+        # The paxmarks mechanism relies on ELF header markings, but the default
+        # grsecurity configuration only enables xattr markings
+        PAX_PT_PAX_FLAGS y
+
         ${if cfg.config.restrictProc then
             "GRKERNSEC_PROC_USER y"
           else