generate-secrets failed due to the `PYTHONPATH` env var that was set
through the nixops19_09 buildInput.
Fixes:
- Don't pull in the build environments of binaries that should be
available in PATH. Only extend PATH instead.
- Run generate-secrets in an empty environment