add <defnix/simple.nix> (extracted from ipsec-wrapper)

changes:
- add `unsafe` argument to use shallow-fetchgit for bootstrapping
- add shallow-fetchgit that does not clone the whole repo and other
 unsafe stuff