CI Caching is Nix

@shymega and I were talking about the feasibility of caching the Nix build in CI. The idea is that our Nix CI builds could go in some sort of S3 cache that our users would get access to. It would enable our users to get access to the built binaries.

Cachix and Attic are options.

Our Nix setup is not the blessed path, and the flake.nix, which builds mainline, is community-maintained. Our blessed cargo install builds are not, in-fact, cached, so I argue that adding a cache to our Nix builds is only secondary to our cargo install path.

I'm opening this issue up as a discussion post for the community. If there is sufficient community interest, we might consider adding this.

The concerns we need to alleviate are:

1. I'd like to see sufficient community interest.
2. How do we mitigate supply chain risk? This is the biggest risk I see. Adding any cache into our system means that any CI run could poison the whole cache. Furthermore, sharing access to this cache to end users means that we're effectively a point which spreads infected software. If we want to enable the cache, we need this to be solved.