Fix broken genJqSecretsReplacementSnippet for jq 1.7 (#257932)

jq 1.7 updated it's behaviour and now throws an error
if the first argument is an empty string. It now needs
"." to pass the input through.

nixos/lib/utils.nix

@@ -177,6 +177,7 @@ rec {
   genJqSecretsReplacementSnippet' = attr: set: output:
     let
       secrets = recursiveGetAttrWithJqPrefix set attr;
+      stringOrDefault = str: def: if str == "" then def else str;
     in ''
       if [[ -h '${output}' ]]; then
         rm '${output}'
@@ -195,10 +196,12 @@ rec {
                (attrNames secrets))
     + "\n"
     + "${pkgs.jq}/bin/jq >'${output}' "
-    + lib.escapeShellArg (concatStringsSep
+    + lib.escapeShellArg (stringOrDefault
-      " | "
+          (concatStringsSep
-      (imap1 (index: name: ''${name} = $ENV.secret${toString index}'')
+            " | "
-             (attrNames secrets)))
+            (imap1 (index: name: ''${name} = $ENV.secret${toString index}'')
+                   (attrNames secrets)))
+          ".")
     + ''
        <<'EOF'
       ${builtins.toJSON set}