pin nixpkgs using a tarball rather than submodule

Submodules are too much of a headache; this commit switches to
pinning a known-good nixpkgs using a tarball rather than a submodule.

README.md

@@ -24,9 +24,6 @@ Because ownerboot is written in [nix](https://nixos.org/manual/nix/unstable/), i
 Copypasta:
 
 ```
-git submodule init
-git submodule update --depth 1 nixpkgs
-export NIX_PATH=$(pwd)
 nix-build --option trusted-public-keys "" src -A kgpe.coreboot    # kgpe-d16 AMD opteron
 nix-build --option trusted-public-keys "" src -A am1i.coreboot    # am1-i AMD kabini
 nix-build --option trusted-public-keys "" src -A kevin.coreboot   # Samsung chromebook rk3399 arm64

doc/build.md

@@ -1,17 +1,12 @@
 # Building Ownerboot
 
-Ownerboot should work with any recent version of nixpkgs.  A submodule
-reference to a known-good nixpkgs revision is included for
-demonstration purposes.
+Ownerboot should work with any recent version of nixpkgs.  By
+default a tarball of a known-good nixpkgs commit will be downloaded;
+you can override this with the `nixpkgs` or `pkgsFun` top-level
+parameters.
 
-```
-git submodule init
-git submodule update --depth 1 nixpkgs
-export NIX_PATH=$(pwd)
-```
-
-Then execute one of the following three lines, depending on which
-platform you want to build for:
+To build ownerboot, execute one of the following three lines,
+depending on which platform you want to build for:
 
 ```
 nix-build --option trusted-public-keys "" src -A kgpe.coreboot    # kgpe-d16 AMD opteron

nixpkgs

@@ -1 +0,0 @@
-Subproject commit db24d86dd8a4769c50d6b7295e81aa280cd93f35

src/default.nix

@@ -1,5 +1,6 @@
-{ lib     ? import <nixpkgs/lib>
-, pkgsFun ? import <nixpkgs>
+{ nixpkgs      ? import ./lib/nixpkgs.nix
+, lib          ? import (nixpkgs + "/lib")
+, pkgsFun      ? import nixpkgs
 , hostPlatform ? null         # if left `null` this will be set based on the ./platform/
 }:
 let

src/lib/nixpkgs.nix

@@ -0,0 +1,7 @@
+let
+  commit = "db24d86dd8a4769c50d6b7295e81aa280cd93f35";
+  sha256 = "1l8r5cmb6wdhv2zpn5dx16753z15pqm1wyixga3k897jvw53gx3s";
+in builtins.fetchTarball {
+  url = "https://github.com/NixOS/nixpkgs/archive/${commit}.tar.gz";
+  inherit sha256;
+}