Derive nix profile from flake: attempt 2

[savil]

Summary

This PR is a re-write of #1692. See motivation and discussion there.

Motivation
This PR seeks to unify our nix print-dev-env and nix profile steps. Other benefits:

• It will enable us to remove some hacks (example, this one introduced for glibc-patch)
• Re-enable some testscripts that were disabled (example, this one for php extension removal)

Previously, these would be two separate processes: we'd manually do nix profile install.
Now, we get the buildInputPaths from nix print-dev-env and install those, so the nix profile is derived from the flake.

Implementation notes

1. In ensureStateIsUpToDate, I had to modify the logic in Derive nix profile from flake: attempt 2 #1724: call d.installPackages that creates plugin files, installs runx and nix packages. Also, move all lockfile operations to the end for all modes, instead of just for recomputeState == true.
2. The nix build operation now happens with the [1/3] [email protected]: Success output that previously would happen with nix profile install.
3. Instead of nixprofiles.NixProfileInstall, we first install via nix build to ensure the package is installed in the local nix store. We then call devbox.syncNixProfile to get the buildInputs from devbox.computeEnv and nix profile install $buildInputs.

How was it tested?

• CICD tests pass
• Did basic sanity checking with devbox add hello cowsay and devbox rm hello cowsay.
• Used the Devbox binary for development for a while.

To verify that we can install packages in /nix/store during devbox add, and then use that during offline in devbox shell:

1. Do devbox add [email protected]
2. Do devbox shell and exit, or just devbox install.
3. Turn Wifi off, and then open devbox shell and verify that the newly installed version of python is used.
   BEFORE: we could skip step 2, because we directly installed packages in the nix profile
   AFTER: step 2 is required because we re-evaluate the flake's environment and derive nix profile from it.

[savil]

Current dependencies on/for this PR:

• main
  • PR [Refactor ensureStateIsUpToDate] split into two modes for when to recompute state #1723
    • PR Derive nix profile from flake: attempt 2 #1724 👈
      • PR [package outputs] generate buildInputs for package-outputs in flake #1721

This stack of pull requests is managed by Graphite.

[savil]

@mikeland73 @gcurtis I think this is 95% there. The insecure example was failing which I think I've now addressed 🤞🏾

PTAL and let me know what you think.

[mikeland73]

Export instead?

[savil]

Since all the fields in this struct are private, I wanted to maintain that constraint. Makes it easier to reason about.

[mikeland73]

!= remove?