Update to NixOS 21.11

Fix use of the iohk binary cache

also format the lists more beautifully

saxtons probably has everything we need so nothing seems to get satisfied from
iohk, let's make sure we can actually satisfy anything at all from iohk

https://nixos.org/manual/nix/stable/command-ref/conf-file.html says there's a
--extra-substituters but nix-build seems to disagree.  maybe a nix/nix-build thing.

$NIX_CONFIG is a nix >=2.4 feature so it doesn't help w/ 2.3

The Nix images have /bin/sh instead so it probably doesn't work

Update to a libchallenge_bypass_ristretto_ffi with correct pkg-config

it depended on now-deleted nix source file
make it use niv sources instead
also drop the NIXPKGS_REV which has been unused for a while

Add a tool for extracting the public key from a signing key

Update haskell.nix version used in CI and deployment.

Prefix all the metric names with "payment_"

Enforce a certain number of tokens on redemption