Add Nix packaging, instructions, and CI

[leif]

this builds on top of #31 - thanks @ehmry !

I don't really know what I'm doing with Nix but CI appears to be generating a package hash which matches what I get when I run it locally in podman, so, that's cool.

[ehmry]

I don't know how this so called Docker stuff works but looks fine to me.

There is contention over whether Nix flakes are better than doing Nix the old-way, but its probably what you want here because you get strong determinism.

[mixmasala]

Great work: I see also the same package name that appears to contain a hash:

sha256sum nix_build/d7l96ghvm2d7jdrkhdpi5h52mmpl7fxm-katzen-unstable-20230617175049/bin/katzen
b8d4fd36df43049a806f65786307b4899435fc70c5babc6ec40eb7d9e7b70c5f  nix_build/d7l96ghvm2d7jdrkhdpi5h52mmpl7fxm-katzen-unstable-20230617175049/bin/katzen

[mixmasala]

I'm not familiar with how Nix packaging works - this works, and I get a local build that matches the CI run:
https://github.com/katzenpost/katzen/releases/tag/test_ae1d8a819d5e30e9751caa39b77b5ef6f768e10d

[mixmasala]

Should vendorHash be constant?

[ehmry]

The vendorHash needs to be a constant. Nix needs a fixed-hash on all it's inputs before it can realize a package. Nix can't guarantee determinism or reproducibility but being strict about inputs is usually good enough. A malicious build system can still change it's behavior according to system fingerprinting, but almost nobody is dealing with that right now.