feat(3p/nix): add --trace-file-access to nix-instantiate

This builds on edef's work with depot-scan by adding a dedicated
flag to the command. We piggyback on upstream's restricted-mode
implementation, the checkSourcePath function.

Change-Id: I52bb613549f40dbca1e8caa036635910c1a3d6d0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/1654
Tested-by: BuildkiteCI
Reviewed-by: glittershark <grfn@gws.fyi>

third_party/nix/src/libexpr/eval.hh

@@ -284,6 +284,10 @@ class EvalState : public gc {
 
   void realiseContext(const PathSet& context);
 
+  /* File access tracing. */
+  void TraceFileAccess(const Path& path);
+  void EnableFileAccessTracing(std::function<void(const Path&)> fn);
+
  private:
   unsigned long nrEnvs = 0;
   unsigned long nrValuesInEnvs = 0;
@@ -299,6 +303,10 @@ class EvalState : public gc {
 
   bool countCalls;
 
+  std::optional<std::function<void(const Path&)>> file_access_trace_fn =
+      std::nullopt;
+  Path last_traced_file = "";
+
   typedef std::map<Symbol, size_t> PrimOpCalls;
   PrimOpCalls primOpCalls;