build system: bump nix sources
package updater: fetch 2014 CVE data
build system: allow overriding fresh Nix src
Document using nixpkgs-monitor for a local task.