Pin haskell.nix

This avoids needless build churn and potentially destabilizing changes from
upstream (though the latter does not seem likely since upstream changes should
not affect packages in our resolver, only newer resolvers).