fix(nix): remove erroneous space in WIN_SIGN_HOST bash default substitution
\${WIN_SIGN_HOST: -HSM} with a space causes bash to parse -HSM as a
substring-from-end offset, treating HSM as a variable. With set -u this
throws "HSM: unbound variable". The correct syntax for a default-value
substitution is \${WIN_SIGN_HOST:-HSM} (no space).
(cherry picked from commit 6a0b73f94349630e3bf0da3a3b60894eb00d95fc)