This looks like a revert of #5844, but is not. That one was needed becaused90f9d4b99 (diff-0f59bb6f197822ef9f19ceae9624989499d170c84dfdc1f486a8959bb4588cafR85)changed the type of the argument to `allowPath` from a `StorePath` to a `Path`. But sincecaabc4f648 (diff-0f59bb6f197822ef9f19ceae9624989499d170c84dfdc1f486a8959bb4588cafL100-R92), it is a `StorePath` again. I think this is worth changing because we want to be very careful about `toRealPath` and the evaluator --- ideally the choice of real path does not affect evaluation at all. So using it fewer times is better.