add nix flake for dependency management

In setting up the CLI for the first time, the docs recommend using at least:

• npm
• npx
• go

The standard CLI flow will require use of sigsum binaries such as sigsum-key and sigsum-submit, but probably also sigsum-policy at least. If the user has go, then they can build those projects from source.

Speaking for myself, I'm comfortable installing go binaries, but less certain how to manage npm and npx versions. I suggest adding a nix flake to provide all dependencies required to run the project. We've already done so over in the backend repo, so facilitate configuring rust and go build chains. Admittedly the backend build environment is more complex than webcat-cli's, but still, I'd like to be able to bootstrap the repo dependencies, and crucially, isolate them from other versions of NPM that may be required for other projects I work on.

Crucially, use of the nix environment should not be required—rather, it should be one option for users who wish to try out the problem. A common pattern for trying out software without installing it, for users of nix, would be:

nix run https://github.com/freedomofpress/webcat-cli -- --help

After we have a flake, we can add it to the docs, as an option for those who want it.

I hope that having a streamlined setup process will slightly lower the bar for new folks to get started, but only if they're already using nix. More immediately, having all required dependencies declared explicitly will unblock more comprehensive integration testing, exercising various workflows in the CLI.