Update to a libchallenge_bypass_ristretto_ffi with correct pkg-config

it depended on now-deleted nix source file
make it use niv sources instead
also drop the NIXPKGS_REV which has been unused for a while

Add a tool for extracting the public key from a signing key

Update haskell.nix version used in CI and deployment.

Prefix all the metric names with "payment_"

Enforce a certain number of tokens on redemption

Also reduce duplication in the test implementation a bit
And add some more error case tests
And remove the old, no-longer used redemption parameter globals
Some Integers becomes Ints for intra-module consistency

With the other changes in this PR, a fresh build of all dependencies is <15m,
so we don't need a large instance. However, the instances *do* have multiple
cores, so take advantage of that.

Update the README to reflect PaymentServer's new API.

Prepend "payment_" to all of our custom metric names to group
metrics from PaymentServer under one name space in Prometheus.

This results in the following metrics being exported:

- payment_processors_stripe_charge_attempts
- payment_processors_stripe_charge_successes
- payment_redemption_signatures_issued
- payment_redemption_voucher_redeemed

The non-custom http endpoints continue to be available under their
Prometheus style labelled names, e.g.
http_responses_total{instance="payments", path="v1/stripe/charge"}

Fix metric names

Update to a newer Haskell.nix and materialize the Nix expressions for PaymentServer

This reduces the amount of memory required to install PaymentServer by ~500MB.

It's called "side effects".
Look it up.