This bundles ca-certs with hetzner-bootstrap.nix, so it should fix #356
where @manveru reported that binary cache substititions didn't work
because of certificate errors.

Although the change is quite trivial I usually try to test things on a
real machine before actually merging it, but I currently don't have a
free Hetzner machine available for testing.

I'm merging this based on @grahamc's assertion "This patch has worked on
provisioning several boxes" and testing this by building and manually
verifying the bootstrap installer and also running the "hetzner" VM test
on x86_64-linux.

So I think the worst thing that could happen is that #356 isn't fixed
after all.

Fixes: #356

GnuPG has a --with-colons flag, so we don't need to use a complicated
sed expression to extract the key ID.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>

I ran into this while trying to run tests prior to merging #564 (merge
commit b09e618).

The default GnuPG version in <nixpkgs> is 2.1, but the Debian version
used while building the Debian repository is GnuPG version 2.0, so we
need to make sure both versions match at least in major and minor.

The test for the Hetzner backend now still fails, but at least it
doesn't fail anymore because one of its dependencies are failing.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>

As we don't have networking access within tests, we also need to add
pkgs.lib{xml2,xslt}.dev or pkgs.lib{xml2,xslt} as fallback.

I'm using .dev here, because it references all of the other outputs of
the corresponding library as well so we don't need to list all the
possible outputs.

Unfortunately, I'm not quite sure what has led to this requirement,
because I don't want to bisect a whole lot of changes since NixOS
release 16.03 just to find out the origin of this.

Adding these dependencies now causes the test to succeed with NixOS
unstable and release-16.09.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>