Support restricted mode: Allow tarball access with search paths.

This allows 'pinch update' to create a new profile.  Updating an
existing profile still doesn't work because nix-env can't read the
existing manifest.

Also, the search path names aren't the best.  Multiple links
probably don't work in restricted mode.  (This tool is deprecated
& is receiving minimal maintenance; patches welcome.)