Which unfree packages are allowed is configured at the flake level via an option.
That is then used in the configuration of Nixpkgs.
See definition at unfree-packages.nix.
See usage at vscode.
The value of this option is available as a flake output:
$ nix eval .#meta.nixpkgs.allowedUnfreePackages