Generate a correct response for the voucher-already-paid case

`throwError voucherAlreadyPaid` above is a red herring.  That codepath works
fine.  It's just unreachable because `payForVoucher` never returns `Left
AlreadyPaid`.  Instead, it does `throwIO AlreadyPaid`.  Servant doesn't know
how to do anything good with `AlreadyPaid` (a `PaymentError` rather than a
`ServerError`) so it logs it and returns a 500 error to the client.

This change adds an exception handler to the `payForVoucher` call that
transforms all `PaymentError` exceptions into `Left e` values which `charge`
is already handling.  `throwError` will eventually throw a `ServerError` with
correct details filled in for these.

Update to NixOS 21.11

Fix use of the iohk binary cache

also format the lists more beautifully

saxtons probably has everything we need so nothing seems to get satisfied from
iohk, let's make sure we can actually satisfy anything at all from iohk

https://nixos.org/manual/nix/stable/command-ref/conf-file.html says there's a
--extra-substituters but nix-build seems to disagree.  maybe a nix/nix-build thing.

$NIX_CONFIG is a nix >=2.4 feature so it doesn't help w/ 2.3

The Nix images have /bin/sh instead so it probably doesn't work

Update to a libchallenge_bypass_ristretto_ffi with correct pkg-config

it depended on now-deleted nix source file
make it use niv sources instead
also drop the NIXPKGS_REV which has been unused for a while

Add a tool for extracting the public key from a signing key

Update haskell.nix version used in CI and deployment.