machines.xerxes: secureify electron_39 for bitwarden-desktop
bitwarden-desktop pulls electron_39, which nixpkgs now marks insecure
(EOL), failing `nix flake check` (eval-xerxes). secureify it via overlay
rather than nixpkgs.config.permittedInsecurePackages, matching the
existing olm fix in mautrix-telegram (lib/secureify.nix).
Assisted-by: Claude Code (claude-opus-4-8[1m])