CoreFoundation is included by the stdenv, moving the decision of what version should be used there makes it possible to override it entirely rather then prepending flags like cf-private does which can be unreliable.
c2b76fa13c