fix(3p/overlays): pin specific version of tpm2-pkcs11

Newer versions broke compatibility with who knows whatever part of the
stack is required for correct TVM + OpenVPN interaction, but I need
this to work.

This was previously picked from stable, but we've bumped stable and it
has advanced to a version where this is also broken.

I believe this is a known issue, but right now I don't have the time
to look into it.

Change-Id: I1060f3ecfd7b43ebe5e1860f59f7574ca094570a
Reviewed-on: https://cl.tvl.fyi/c/depot/+/10743
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI

third_party/overlays/tvl.nix

@@ -132,4 +132,9 @@ depot.nix.readTree.drvTargets {
       license = licenses.asl20;
     };
   };
+
+  # OpenVPN + TPM2 is broken on versions of this package somewhere
+  # after 1.8.0, but it is a critical dependency for tazjin. For this
+  # reason it is vendored from a specific nixpkgs commit.
+  tpm2-pkcs11 = self.callPackage ./patches/tpm2-pkcs11.nix { };
 }