add patch to fix failing "tenant_files" migration

The new migration in tenant_files.py references a MEDIA_ROOT directory
based on its own path, which in our case is in the read-only /nix/store.

We need it to refer to the actual authentik state directory instead,
which defaults to /var/lib/authentik/media in module.nix

module.nix

@@ -150,6 +150,7 @@ in
             User = "authentik";
             ExecStart = "${cfg.authentikComponents.migrate}/bin/migrate.py";
             EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+            inherit (config.systemd.services.authentik.serviceConfig) StateDirectory;
           };
         };
         authentik-worker = {