NixOS: use pinned dependencies

[roberth]

The Nix C++ interface is not stable, so dwarffs needs regular updates to stay compatible. However, that's generally not worth the effort, as I don't think it uses any particularly critical or fast changing components, so let's make sure that it always builds by pinning nix. TODO: confirm my assumption; make sure an outdated Nix is not hazardous.

[edolstra]

An outdated Nix should be fine, since we only use it for fetching files and parsing NARs.

[roberth]

Oh, turns out I didn't use the first commit in the end. I think it's a bit cleaner than with, but I could remove it if you prefer.