ssh-agent: add allowedPKCS11Providers option

tests/modules/services/ssh-agent/linux/default.nix

@@ -1,4 +1,5 @@
 {
   ssh-agent-basic-service = ./basic-service.nix;
   ssh-agent-timeout-service = ./timeout-service.nix;
+  ssh-agent-pkcs11-service = ./pkcs11-service.nix;
 }

tests/modules/services/ssh-agent/linux/pkcs11-service-expected.service

@@ -0,0 +1,9 @@
+[Install]
+WantedBy=default.target
+
+[Service]
+ExecStart=@openssh@/bin/ssh-agent -D -a %t/ssh-agent -P '/nix/store/*/lib,/usr/lib/libpkcs11.so,/usr/lib/other.so'
+
+[Unit]
+Description=SSH authentication agent
+Documentation=man:ssh-agent(1)

tests/modules/services/ssh-agent/linux/pkcs11-service.nix

@@ -0,0 +1,16 @@
+{
+  services.ssh-agent = {
+    enable = true;
+    pkcs11Whitelist = [
+      "/nix/store/*/lib"
+      "/usr/lib/libpkcs11.so"
+      "/usr/lib/other.so"
+    ];
+  };
+
+  nmt.script = ''
+    assertFileContent \
+      home-files/.config/systemd/user/ssh-agent.service \
+      ${./pkcs11-service-expected.service}
+  '';
+}