make-sandboxed: fix to preserve the specified output, for packages like dig

modules/programs/make-sandboxed.nix

@@ -500,12 +500,16 @@ let
       '';
     };
     packageWrapped = sandboxedBy."${wrapperType}";
-  in
-    fixupMetaAndPassthru pkgName packageWrapped (passthru // {
+    packageWithMeta = fixupMetaAndPassthru pkgName packageWrapped (passthru // {
       # allow the user to build this package, but sandboxed in a different manner.
       # e.g. `<pkg>.sandboxedBy.inplace`.
       # e.g. `<pkg>.sandboxedBy.wrappedDerivation.sandboxedNonBin`
       inherit sandboxedBy;
-    })
+    });
+  in if package.outputSpecified or false then
+    # packages like `dig` are actually aliases to `bind.dnsutils`, so preserve that
+    packageWithMeta."${package.outputName}"
+  else
+    packageWithMeta
   ;
 in make-sandboxed