repeatable nixos-rebuild using git commit-ids

Add options:
- system.repeatableBuild.enable
- system.repeatableBuild.uri
- system.repeatableBuild.refid
- system.repeatableBuild.binaryCache

Modify nixos-rebuild.sh to download nixpkgs tarball from local git,
remote git, and github.

Add unpack-github-tarball.nix to unpack the tarball into nix store.

Usage: if configuration.nix contains the following options,
nixos-rebuild will use the NixOS/nixpkgs github repository at commit
61befa...

    system = {
      nixpkgsRepository = {
        enable = true;
        uri = "NixOS/nixpkgs";
        refid = "61befa04511551e3bdcb8150553e5c87bcd5abe3";
      };
    };

NOTE: as of this commit, NIX_CURL_FLAGS must contain "-k" to prevent
curl checking cacerts. I.e., `sudo NIX_CURL_FLAGS=-k nixos-rebuild
switch`. Not yet sure how to fix this.