Reproducible builds (e.g. via Nix / Bazel)

Currently, building of unsigned binaries may not be entirely deterministic. It'd be good to port the build infrastructure to use tools that enable reproducible builds, such as Nix or Bazel.
It'd require to port the build infrastructure of https://github.com/intel/linux-sgx as well.

Start by mapping the repository's existing build infrastructure and the corresponding build infrastructure in intel/linux-sgx, then compare whether Nix or Bazel fits the requested reproducible-build goal. Done means unsigned binaries from both build paths are deterministic and the updated infrastructure is documented and validated.

Written by the indexing model from the issue text.