Improve Tahoe-LAFS packaging

They fail a lot so leave them disabled.

We do so by introducing a limitation that the client must be configured with
an issuer and it must match the issuer announced by any storage server the
client is to talk to.

The client will decline to speak to any storage server without a matching
issuer.

This may make no difference but we're not doing anything to override
openssl_1_1 in this overlay so we don't need to get it from `self`.

Although ... the client resource doesn't really the part of the redeemer that
needs the announcement.  Maybe that part of the redeemer belongs somewhere
else.  Probably.

The Nix packaging for PrivacyPass

lots of mess to clean up though

Passes cannot be constructed until we know how we're going to use them since
they are derived from the unblinded tokens and an operation-specific message.

OpenSSL 1.1.1c for Nix env

Fixes: #27 

openssl_1_1 in the pinned version of nixpkgs is 1.1.1c.

Create a `ci` profile and select it.

Fixes: #25 

This gives us deterministic, portable (across time) builds w/ nix.