OpenSSL 1.1.1c for Nix env

Fixes: #27 

openssl_1_1 in the pinned version of nixpkgs is 1.1.1c.

Create a `ci` profile and select it.

Fixes: #25 

This gives us deterministic, portable (across time) builds w/ nix.

Put ZKAPs into and take ZKAPs out of a database

Fixes: #18 

It returns a list of Passes.  Encode them appropriately for Foolscap.

Instead of never getting any passes, immediately get a pile of bogus passes!

Separate mutable writes from lease updates.

Rename "Secure Access Tokens"

Rename "Payment Reference Numbers"