These pieces are clearly not necessary and removing them makes the system
closure a bit smaller.

There are still many more pieces that *seem* like they should be unnecessary
that get pulled into a build.  However, these are only *build* time
dependencies and it's somewhat harder to get rid of them: it requires either
passing non-default arguments to the Nix expression defining the
derivation (not too hard, only works where supported, determined on a
case-by-case basis), modifying the Nix expressions themselves for each package
to remove the unwanted dependencies (harder, only works where supported,
determined on a case-by-case basis), or actually modifying the upstream
software and/or its build system to eliminate the dependency (very hard,
unlikely to be worth pursuing in general).

Once we consider the runtime closure and the build time closure separately,
our system sizes are not that bad - around 500MB (payment a little smaller,
storage node a little bigger).

Fix the empty machines

See merge request opensource/PrivateStorageio!74

morph 1.5.0 fails to build with the golang runtime surrounding it

Merge develop into staging

See merge request opensource/PrivateStorageio!73

Replace nixpkgs overlays with a nixpkgs fork and upgrade to OpenSSL 1.1.1k

Closes #62

See merge request opensource/PrivateStorageio!72

The IP address is given as an argument

I hope this reduces the chances of running into this intermittent problem:

```
api_stripe_com# Timed out waiting for device /dev/vda, trying to mount anyway.
storage: exit status 0
(12.56 seconds)
storage: must succeed: [ -e /var/db/tahoe-lafs/storage/logs/eliot.json ]
storage: exit status 0
(0.00 seconds)
client: must succeed: set -eo pipefail; /nix/store/y56dhm5sap38iai2lkdn5n1lwn52z09d-run-client.py /tmp/client pb://rr7y46ixsg6qmck4jkkc7hke6xe4sv5f@tcp:introducer:35151/2k6
p3wrabat5jrj7otcih4cjdema4q3m http://issuer/ | systemd-cat
client: waiting for the VM to finish booting
client: connected to guest root shell
client: (connecting took 0.00 seconds)
(0.00 seconds)
api_stripe_com# [  154.358922] 9pnet: Installing 9P2000 support
api_stripe_com# [  156.637047] virtio_blk virtio8: [vda] 1048576 512-byte logical blocks (537 MB/512 MiB)
api_stripe_com# cannot check filesystem with type "auto"!
api_stripe_com# mounting /dev/vda on /...
api_stripe_com# mount: mounting /dev/vda on /mnt-root/ failed: No such file or directory
api_stripe_com# [  156.692286] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
api_stripe_com# [  156.692286]
api_stripe_com# [  156.695508] CPU: 0 PID: 1 Comm: init Not tainted 4.19.80 #1-NixOS
api_stripe_com# [  156.697682] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
api_stripe_com# [  156.701427] Call Trace:
api_stripe_com# [  156.702238]  dump_stack+0x5c/0x80
api_stripe_com# [  156.703518]  panic+0xe7/0x23b
api_stripe_com# [  156.704457]  do_exit.cold.24+0x1a/0x81
api_stripe_com# [  156.705812]  ? handle_mm_fault+0xd6/0x200
api_stripe_com# [  156.707211]  do_group_exit+0x3a/0xa0
api_stripe_com# [  156.708605]  __x64_sys_exit_group+0x14/0x20
api_stripe_com# [  156.710056]  do_syscall_64+0x4e/0x100
api_stripe_com# [  156.711387]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
api_stripe_com# [  156.713039] RIP: 0033:0x7f7c73b0f676
api_stripe_com# [  156.714201] Code: Bad RIP value.
api_stripe_com# [  156.715490] RSP: 002b:00007ffce6679da8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7
api_stripe_com# [  156.717860] RAX: ffffffffffffffda RBX: 0000000002239704 RCX: 00007f7c73b0f676
api_stripe_com# [  156.719931] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
api_stripe_com# [  156.722315] RBP: 0000000000000001 R08: 00000000000000e7 R09: ffffffffffffff80
api_stripe_com# [  156.724720] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffce667a138
api_stripe_com# [  156.727106] R13: 00007ffce667a130 R14: 0000000000000000 R15: 0000000000000000
api_stripe_com# [  156.729583] Kernel Offset: 0xfc00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
api_stripe_com# [  156.732988] Rebooting in 1 seconds..
vde_switch: EOF data port: Interrupted system call
```

The nixpkgs fork already contains all of the changes our overlays were
responsible for - but as direct nixpkgs changes instead.

Fix privatestorageops issue 278: Unknown key name 'LimitNOFILESoft'

Closes privatestorage/privatestorageops#278

See merge request opensource/PrivateStorageio!70

Bring Staging up to current Develop version

See merge request opensource/PrivateStorageio!71

Add deployment environment names

See merge request opensource/PrivateStorageio!68

Systemd sets soft limits by using a <soft:hard> range, see
https://github.com/systemd/systemd/pull/1994. We want soft
and hard limit to be the same, so we use the IMO defective
former behavior of setting the limit once and have systemd
set both. RedHat Bug 1351415 has more informatin about not
being able to set soft limits within the systemd config in
before https://bugzilla.redhat.com/show_bug.cgi?id=1351415

See https://docs.gitlab.com/ee/ci/environments/

Run vulnerability scan on CI

See merge request opensource/PrivateStorageio!64

still pretty hard to consume