fix(3p/nix): Fix all remaining compiler warnings

This compiles under `-Wall -Werror`.

The largest chunk of this change is `final` qualifiers for the various
Nix CLI command structs, which inherit from a Command class that has
more virtual functions than are implemented by each command.

Change-Id: I0925e6e1a39013f026773db5816e4a77d50f3b4a
Reviewed-on: https://cl.tvl.fyi/c/depot/+/1294
Tested-by: BuildkiteCI
Reviewed-by: isomer <isomer@tvl.fyi>
Reviewed-by: kanepyork <rikingcoding@gmail.com>

third_party/nix/src/libstore/local-store.cc

@@ -490,10 +490,18 @@ static void canonicalisePathMetaData_(const Path& path, uid_t fromUid,
     if (inodesSeen.find(Inode(st.st_dev, st.st_ino)) == inodesSeen.end()) {
       throw BuildError(format("invalid ownership on file '%1%'") % path);
     }
+
+// `mode` variable is only used in debug builds
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wunused-variable"
+
     mode_t mode = st.st_mode & ~S_IFMT;
     assert(S_ISLNK(st.st_mode) ||
            (st.st_uid == geteuid() && (mode == 0444 || mode == 0555) &&
             st.st_mtime == mtimeStore));
+
+#pragma clang diagnostic pop
+
     return;
   }