Update nixpkgs

[dpausp]

Pull upstream NixOS changes, security fixes and package updates:

• clamav: 1.0.1 -> 1.0.3
• curl: apply patch for CVE-2023-38039
• curl: apply patch for CVE-2023-38545
• ghostscript: 10.01.2 -> 10.02.0
• gitlab-runner: 16.1.0 -> 16.4.0
• github-runner: 2.309.0 -> 2.310.2
• go_1_19: 1.19.12 -> 1.19.13
• imagemagick: 7.1.1-18 -> 7.1.1-19
• libwebp: 1.3.1 -> 1.3.2 (CVE-2023-4863)
• linux: 6.1.55 -> 6.1.57
• nss_latest: 3.93 -> 3.94
• openssl: 3.0.10 -> 3.0.11 (CVE-2023-4807)
• percona-xtrabackup_8_0: 8.0.32-26 -> 8.0.34-29
• python310: 3.10.12 -> 3.10.13 (CVE-2023-40217)
• python311: 3.11.4 -> 3.11.5 (CVE-2023-40217)
• redis: 7.0.12 -> 7.0.13 (CVE-2023-41053)
• xorg.libX11: 1.8.6 -> 1.8.7

Additional changes:

• gitlab-runner: remove override so we get 16.4.0 instead of 16.1.0.
• percona-xtrabackup_8_0: remove override to use newer package from upstream
• Add more important packages: Adds packages like chromium and various libraries which are used by our
  internal tooling but are also of general interest.

PL-131842

@flyingcircusio/release-managers

Release process

Impact:

• [NixOS 23.05] VMs will reboot after the update.

Changelog:

• Pull upstream NixOS changes, security fixes and package updates (PL-131842):
  (include changes from above)

Security Implications

• Security requirements defined? (WHERE)
  • pull in upstream security fixes regularly
• Security requirements tested? (EVIDENCE)
  • automated tests still run, works on various test VM, checked that gitlab-runner on staging Gitlab works properly
  • checked commit log for fixed CVEs and possible problems with updates

[osnyx]

LGTM.

This could be an opportunity to add some further important packages from https://github.com/flyingcircusio/fc-nixos/pull/810/files#diff-d38943e0f8cb4837f3247f265b42d1f03996bf06f5f0938be8878e669f024b2b

[dpausp]

LGTM.

This could be an opportunity to add some further important packages from https://github.com/flyingcircusio/fc-nixos/pull/810/files#diff-d38943e0f8cb4837f3247f265b42d1f03996bf06f5f0938be8878e669f024b2b

yes, they are included.