tests: rework derivation stubbing

Instead of having to manually stub packages that should not be
downloaded we instead automatically stub all packages (except a small
list of whitelisted ones). Tests can re-introduce the real package by
using the `realPkgs` module argument.

tests/modules/programs/git-credential-oauth/extra-flags.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, ... }:
 
 {
   programs.git-credential-oauth = {
@@ -8,8 +8,6 @@
 
   programs.git = { enable = true; };
 
-  test.stubs.git-credential-oauth = { };
-
   nmt.script = ''
     assertFileExists home-files/.config/git/config
     assertFileContains \