The biggest nixpkgs-specific change is addition of printf()-style
attribute annotations for many ncurses APIs. -Werror=format-security
now flags parameter inconsistencies and fails the build.
The fixes are usually one-liners like adding "%s" format string for
non-literals or just using `hardeningDisable [ "format" ];` for software
where backporting or fixing is not practical.
Drop -DNCURSES_INTERNALS=1 workaround required only for ncurses-6.2
and build-incompatible with ncurses-6.3.