refactor(fuchsia): reorganize audio and bluetooth configuration

Separated PipeWire audio configuration from bluetooth hardware settings for
better logical organization. Moved bluetooth config to hardware-configuration.nix
alongside kernel module workarounds (disable_ertm, iwlwifi power_save).

Also added documentation for permittedInsecurePackages in global config and
updated flake dependencies.

nixos/common/global/default.nix

@@ -35,6 +35,12 @@
           # Services
           "minecraft-server"
         ];
+
+      # Allow specific packages with known CVEs when required by dependencies.
+      # Only add packages here when no secure alternative exists.
+      permittedInsecurePackages = [
+        "mbedtls-2.28.10" # required for orca-slicer
+      ];
     };
   };