refactor: Move nixpkgs attribute to third_party.nixpkgs

Please read b/108 to make sense of this.

This gets rid of the explicit list of exposed packages from nixpkgs,
and instead makes the entire package set available at
`third_party.nixpkgs`.

To accommodate this, a LOT of things have to be very slightly shuffled
around. Some of this was done in already submitted CLs, but this
change is unfortunately still quite noisy.

Pay extra attention to:

* overlay-like functionality that was partially moved to actual
  overlays (partially as in, the minimum required to get a green
  build)

* modified uses of the package set path, esp. in NixOS systems

Special notes:

* xanthous has been disabled in CI because of issues with the Haskell
  overlay
* //third_party/nix has been disabled because of other unclear
  dependency issues

Both of these will be tackled in a followup CL.

Change-Id: I2f9c60a4d275fdb5209264be0addfd7e06c53118
Reviewed-on: https://cl.tvl.fyi/c/depot/+/2910
Reviewed-by: glittershark <grfn@gws.fyi>
Reviewed-by: sterni <sternenseemann@systemli.org>
Tested-by: BuildkiteCI

web/cgit-taz/default.nix

@@ -1,11 +1,15 @@
 # This derivation configures a 'cgit' instance to serve repositories
 # from a different source.
-
-{ depot, ... }:
-
-with depot.third_party;
+{ depot, pkgs, ... }:
 
 let
+  inherit (pkgs)
+    mime-types
+    thttpd
+    writeShellScriptBin
+    writeText
+    ;
+
   sourceFilter = writeShellScriptBin "cheddar-about" ''
     exec ${depot.tools.cheddar}/bin/cheddar --about-filter $@
   '';
@@ -33,7 +37,7 @@ let
 
   thttpdConfig = writeText "thttpd.conf" ''
     port=2448
-    dir=${cgit}/cgit
+    dir=${depot.third_party.cgit}/cgit
     nochroot
     novhost
     cgipat=**.cgi

web/converse/default.nix

@@ -1,6 +1,6 @@
-{ pkgs, ... }:
+{ depot, pkgs, ... }:
 
-pkgs.naersk.buildPackage {
+depot.third_party.naersk.buildPackage {
   src = ./.;
   buildInputs = with pkgs; [ openssl postgresql.lib ];
   nativeBuildInputs = [ pkgs.pkgconfig ];

web/todolist/default.nix

@@ -2,12 +2,12 @@
 #
 # Only TODOs that match the form 'TODO($username)' are considered, and
 # only for users that are known to us.
-{ depot, lib, ... }:
+{ depot, lib, pkgs, ... }:
 
 with depot.nix.yants;
 
 let
-  inherit (depot.third_party)
+  inherit (pkgs)
     jq
     ripgrep
     runCommandNoCC