Improve image-pulling Nix functions

[m-bdf]

• Rewrite the buildImageBlob script in pullImageFromManifest to support more registries (e.g nvcr.io doesn't return a service= param in its WWW-Authenticate header)
• Add cacert to nativeBuildInputs to use its setup hook instead of explicitly setting SSL_CERT_FILE in pullImage and buildImageBlob
• Other small improvements in Nix code

Better reviewed commit by commit :)

[mikepurvis]

@mikepurvis since you contributed this pull method, could you try this branch in your environment to ensure there is no regression?

Thanks for the ping! I'm actually not at that company any more, so I'm not in a good position to validate it.

Overall looks good though, a bunch of nice bits of cleanup.

[m-bdf]

Fixed! All workflows are now passing

[nlewo]

Thank you all for these nice improvements!