Generic Nix build action

[ro-tex]

This PR adds a generic GHA that can build a Nix project and cache its artefacts on S3.

TODO: This PR should probably be adapted to augment the setup-nix action, instead of being a separate one.

Example usage:

      - name: Build and cache
        uses: smartcontractkit/.github/actions/nix-build
        with:
          cache-url: s3://${{ secrets.NIX_CACHE_S3_BUCKET }}?region=${{ secrets.AWS_REGION }}
          cache-privkey: ${{ secrets.NIX_BINARY_SIGNING_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}
          role-to-assume: ${{ secrets.AWS_OIDC_IAM_ROLE_PUBLISH_ARN }}
          role-duration-seconds: ${{ secrets. AWS_ROLE_DURATION_SECONDS }}

[chainchad]

Looks good. Left some general feedback. Might want another reviewer more familiar with nix to review those specific steps though.

[chainchad]

Shouldn't we enforce signing?

[chainchad]

I suppose to enforce we could add a check where if setup-only != true and this is empty, to fail?

[ro-tex]

In theory you can use this action without any cache setup - it will still build your flake and all derivations. It will just be slower.

[chainchad]

Suggested change

	aws-access-key-id: ${{ inputs.aws-access-key-id }}
	aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
	aws-access-key-id: ${{ inputs.aws-access-key-id }}
	aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
	mask-aws-account-id: true

Don't think we need access keys (see earlier comment) and we should mask the AWS account ID so it doesn't appear in logs.

[ro-tex]

Access key and accompanying fields removed.

GitHub already does the masking for us - anything that comes from the secrets appears as *** in the output of the action.

Example:

Run aws-actions/configure-aws-credentials@v4
  with:
    aws-region: ***
    aws-access-key-id: ***
    aws-secret-access-key: ***
    audience: sts.amazonaws.com
  env:
    NIX_PATH: nixpkgs=channel:nixos-unstable
    TMPDIR: /home/runner/work/_temp
Proceeding with IAM user credentials
Run # run check package builds
  # run check package builds
  nix flake check --impure --all-systems
  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
  env:
    NIX_PATH: nixpkgs=channel:nixos-unstable
    TMPDIR: /home/runner/work/_temp
    AWS_DEFAULT_REGION: ***
    AWS_REGION: ***
    AWS_ACCESS_KEY_ID: ***
    AWS_SECRET_ACCESS_KEY: ***