Add option disallow-copy-paths to track down unnecessary copying

[roberth]

Motivation

To quote the docs:

This is useful for finding expressions which copy sources, which can slow down evaluation.
You may find copied sources by running nix commands with increased verbosity, such as nix build -vvvv 2>&1 | grep /nix/store.
After identifying one more more paths, run nix build --option disallow-copy-paths /nix/store/... --show-trace to find the expression that copies the path, or add --debugger.

Context

Priorities and Process

Add 👍 to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.

[Ericson2314]

std::string?

[Ericson2314]

Like the idea

[roberth]

We chatted a bit that the meaning of these strings may have to change a bit. Currently they're absolute paths, and that's ok for now, but we'll need something else when we have virtual paths.
Ideally whatever Nix logs about can be passed into this setting verbatim, in support of the workflow in the option description.

Perhaps easier to use would be an option where you can specify globs of forbidden file names which may be fetched and read, but not copied. A simple *.nix may already be a useful check for most projects, capable of finding unintentional Nixpkgs copying (although NixOS does put nixos/ in the sandbox for building the manual)

An option where you specify substrings of file contents that mustn't be copied would also be interesting, but quickly turns in a security feature that I don't know if we want to support. Maybe later.

[roberth]

I think this should implement the globbing idea instead. It's a bit more work, requiring something like a nar sink wrapper and some more glue, but digging through logs is bad UX.
Marked as draft.