lots of mess to clean up though

Passes cannot be constructed until we know how we're going to use them since
they are derived from the unblinded tokens and an operation-specific message.

OpenSSL 1.1.1c for Nix env

Fixes: #27 

openssl_1_1 in the pinned version of nixpkgs is 1.1.1c.

Create a `ci` profile and select it.

Fixes: #25 

This gives us deterministic, portable (across time) builds w/ nix.

Put ZKAPs into and take ZKAPs out of a database

Fixes: #18 

It returns a list of Passes.  Encode them appropriately for Foolscap.

Instead of never getting any passes, immediately get a pile of bogus passes!

Separate mutable writes from lease updates.