nixos/prometheus-mail-exporter: support storing `passphrase` outside of the store, use umask when using envsubst