Stop using ancient nix_2_3

Nix commit 787469c7b66aec12ab6847e7db2cdc8aef5c325e removed
<nix/unpack-channel.nix>, preferring to stuff its contents into the nix
binary & write it out to a temp file to use it.

Pinch unpacks channels.  So to retain access to unpack-channel.nix,
pinch pinned its nix dependency to nix 2.3.

This is no longer viable.  The 2.3 branch is no longer maintained.
It now has known security vulnerabilities, noted in knownVulnerabilities
(which causes it to refuse to build).

So now pinch does it the same way as nix, holding its own little
unpack-channel.nix and writing it out to a temp file to use it.

This lets us go back to not caring about the version of the nix
dependency.