Introduce general overrideable composition

See the comments on lib.composable for how to make a function composable
with this mechanism.

See the comments on lib.call-composable for how to call a composable
function.

See the definition of the composed variable in ipsec-wrapper.nix to see
how it's all put together.

Some design decisions:

* Overriding is performed on the arguments to functions, not on the
  final values in the set. This sidesteps several shortcomings of the
  overriding interface in nixpkgs:
  * makeOverridable only works on functions that directly return a set,
    and pollutes that set's namespace.
  * deep overriding is really inefficient.
  * There's no way to get at an uncomposed version of the package set to
    apply an alternative composition.
  * Overriding nested sets is generally hacky and ad-hoc
* Packages/functions are separated into build-support (needed at build
  time) and pkgs (needed at run and possibly build time).
* Packages pulled from nixpkgs are "wrapped" by composable functions in
  the appropriate category.
* Packages pulled from nixpkgs come from a hard-coded revision of
  nixpkgs, not any checkout in the environment.
* When a newer nixpkgs is needed for whatever reason, it will only be
  used for the packages that need it, with the old checkouts being kept
  until no packages are pulled from them.
* nixpkgs is bootstrapped with git in $PATH, not with a full nixpkgs
  checkout in the environment.
* We have our own nix lib.
* A technically-unecessary @-binding is used to distinguish which set
  composable arguments come from, for readability.

Note that currently every time we add a new composable function we have
to add its name to the list in the relevant default.nix; if
NixOS/nix#360 is merged this should be ameliorated.