Nix integration

[NorfairKing]

I'd love to be able to run an audit inside a nix build.
It would be amazing if the cabal-audit flake could expose a lib function that turns an advisory repository, an "ignore" config file, and haskell packages into an audit check.

Currently this isn't possible because:

1. There is no way to ignore advice
2. The --file-patch and --repository flags expect a directory with a .git directory and nix filters those out.
3. ... ? Who knows, I didn't get this far.

[MangoIV]

This is blocked by #27 and another problem: nix doesn't deal well with .git dirs, that means that for now there's no good way of purely loading advisories. this is a problem with how the security advisories database is implemented.

[NorfairKing]

@MangoIV Yes but this issue should guide the design of #27 IMO.

If the advisory database needs a .git directory then it needs fixing.

[MangoIV]

yes, it definitely needs fixing. eventually the "out out band data should be materialized and completely removed from the security advisories DB, see also:

haskell/security-advisories#179

cc @elland for this

[MangoIV]

another relevant issue in haskell/security-addvisories: haskell/security-advisories#176

[MangoIV]

I should really prioritize this. there's a lot that is currently blocked by these out of band things.