Motivation for this change

Reattempting #39323 (/cc @Mic92). I've squashed the commits together into one for easy reverting if hydra chokes on it again, but I don't think it'll be necessary since I've moved the import-from-derivation behind a function.

With this branch:

$ env NIX_PATH=nixpkgs=$HOME/dev/nix/nixpkgs/ nix-instantiate maintainers/scripts/find-tarballs.nix --eval --strict --arg expr '(import <nixpkgs> {}).nix-pin' --show-trace --restrict-eval
# ( lots of tarballs )

On the previous PR, the above command failed with the same error as hydra (https://hydra.nixos.org/build/73131644/nixlog/1)

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Fits CONTRIBUTING.md.