NOT FOR MERGE: geoclue: disable polkit write access to the modem

unfortunately, geoclue misinterprets that as thinking it doesn't have *read* access either

hence, though it does prevent geoclue from changing GPS settings, it actually causes geoclue to simply not even read GPS (nor GSM)

hosts/common/programs/geoclue2.nix

@@ -40,6 +40,16 @@ in
 
   # sane.programs.geoclue2.enableFor.system = lib.mkIf (builtins.any (en: en) (builtins.attrValues cfg.enableFor.user)) true;
 
+  # prevent geoclue from modifying the GPS settings: i manage that myself, and trying to co-manage it with geoclue causes issues.
+  security.polkit.extraConfig = lib.optionalString cfg.enabled ''
+    polkit.addRule(function(action, subject) {
+      if (subject.user == "geoclue" && action.id == "org.freedesktop.ModemManager1.Device.Control") {
+        return polkit.Result.NO;
+      }
+    });
+  '';
+
+
   services.geoclue2 = lib.mkIf cfg.enabled {
     enable = true;
     geoProviderUrl = "http://127.0.0.1:8088/v1/geolocate";  #< ols