patch-shebangs.sh: fix for macos sandbox (#414448)

pkgs/build-support/setup-hooks/patch-shebangs.sh

@@ -68,6 +68,18 @@ patchShebangs() {
         return 0
     fi
 
+    # like sponge from moreutils but in pure bash
+    _sponge() {
+        local content
+        local target
+        content=""
+        target="$1"
+        while IFS= read -r line || [[ -n "$line" ]]; do
+            content+="$line"$'\n'
+        done
+        printf '%s' "$content" > "$target"
+    }
+
     local f
     while IFS= read -r -d $'\0' f; do
         isScript "$f" || continue
@@ -126,11 +138,14 @@ patchShebangs() {
 
                 # Preserve times, see: https://github.com/NixOS/nixpkgs/pull/33281
                 timestamp=$(stat --printf "%y" "$f")
-                sed -i -e "1 s|.*|#\!$escapedInterpreterLine|" "$f"
+                sed -e "1 s|.*|#\!$escapedInterpreterLine|" "$f" | _sponge "$f"
+
                 touch --date "$timestamp" "$f"
             fi
         fi
     done < <(find "$@" -type f -perm -0100 -print0)
+
+    unset -f _sponge
 }
 
 patchShebangsAuto () {