services: use doas if enabled

- Remove sudo from recurring-donations path because it's not used by
  the service

- Use doas instead of sudo in secure-node.nix

modules/modules.nix

@@ -57,6 +57,14 @@ with lib;
             "$@"
         '';
       };
+
+      # A helper for using doas instead of sudo when doas is enabled
+      runAsUserCmd = mkOption {
+        readOnly = true;
+        default = if config.security.doas.enable
+                  then "doas -u"
+                  else "sudo -u";
+      };
     };
   };