Switch nixpkgs to a custom repository

There is a problem in the way pkgsStatic is constructed, causing our
-march argument to be missed, leading to binaries that fail to run. This
affects only security wrappers so far (mount, sudo, ...) but it will
likely affect any pkgsStatic binary.