chore(3p/sources): Bump channels & overlays

* //3p/nixpkgs: allow insecure qtwebkit, since a package
  in grfn's home depends on it. Reasoning for marking
  qtwebkit as insecure is given here:
  https://blogs.gnome.org/mcatanzaro/2022/11/04/stop-using-qtwebkit/

* //3p/gerrit: update nondeterministic bazel output hash

Change-Id: Ie652905969bf43abb457f6af211f771cff093dce
Reviewed-on: https://cl.tvl.fyi/c/depot/+/7353
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>

third_party/nixpkgs/default.nix

@@ -28,6 +28,11 @@ let
         # Forbids our meta.ci attribute
         # https://github.com/NixOS/nixpkgs/pull/191171#issuecomment-1260650771
         checkMeta = false;
+        # TODO(grfn): Currently needed for subsurface, set globally to avoid
+        # reimporting nixpkgs in home-manager
+        permittedInsecurePackages = [
+          "qtwebkit-5.212.0-alpha4"
+        ];
       };
 
     inherit localSystem;