- convert cachix cache name from an env into a secret so it (along
  with the token/key) can be set once per fork
- use CACHIX_AUTH_TOKEN in addition to CACHIX_SIGNING_KEY; it looks
  like cachix will try signing key first, then auth token.

To prepare for the upcoming DrvOutputSubstitutionGoal

Local git repositories are normally used directly instead of
cloning. This commit checks if a repo is bare and forces a
clone.

Co-authored-by: Théophane Hufschmitt <regnat@users.noreply.github.com>

Add support for bare git repositories when using git+file

simplify changing cachix cache for install tests

Substitute content-addressed derivations

Not exposed anywhere, but built realisations are now signed (and this
should be forwarded when copy-ing them around)

I guess the rationale behind the old name wath that
`pathInfoIsTrusted(info)` returns `true` iff we would need to `blindly`
trust the path (because it has no valid signature and `requireSigs` is
set), but I find it to be a really confusing footgun because it's quite
natural to give it the opposite meaning.

Broken atm

Don't let them inherit the signature from the parent one (because it
makes no sense to do so), but re-sign them after they have been built