make-sandboxed: fix multi-output packages and sandbox *all* their outputs

this mostly applies to the wrapperType = 'inplace' users

modules/programs/make-sandboxed.nix

@@ -95,12 +95,16 @@ let
         done
       }
 
-      if [ -e "$out/bin" ]; then
+      for output in $outputs; do
-        crawlAndWrap "$out/bin"
+        local outdir=''${!output}
-      fi
+        echo "scanning output '$output' at $outdir for binaries to sandbox"
-      if [ -e "$out/libexec" ]; then
+        if [ -e "$outdir/bin" ]; then
-        crawlAndWrap "$out/libexec"
+          crawlAndWrap "$outdir/bin"
-      fi
+        fi
+        if [ -e "$outdir/libexec" ]; then
+          crawlAndWrap "$outdir/libexec"
+        fi
+      done
     '';
   });