Update nix channel for python; use stock pip; monkeypatch pip to chan…

[airportyh]

…ge shebang line

Why

1. We want to upgrade Python to nixpkgs-unstable
2. due to an update in nixpkgs, we had to change how we package pip, we chose to:
   a. use the stock pip instead of our custom one
   b. add back a customization for the shebang line via monkeypatching, via python site customization, which has the advantage of working for a pip that's been installed in .pythonlibs. Thanks @blast-hardcheese for this!

What changed

1. Use unstable channel for Python 3.10 and 3.11, but not 3.8.
2. Updated pip to use stock pip, plus site customization
3. set break-system-packages = yes to silence this error

Test plan

1. create a Python Repl
2. pip install gunicorn
3. cat .pythonlibs/bin/gunicorn see that the shebang line starts with #!/usr/bin/env python3
4. make sure template tests (in particular pip and poetry tests) pass

[airportyh]

@blast-hardcheese I think we should expose PIP_CONFIG_FILE var to the repl so that an upgraded pip will have break-system-packages = yes set as well.

[airportyh]

@blast-hardcheese I think we want to make the script not break if for some reason pip was not available on PYTHONPATH.

[airportyh]

I can't find a way to break it by setting the PYTHONPATH though, so it ok.

[ryantm]

I'm concerned about the test plan here, because it already does what the test plan says without this change.

[blast-hardcheese]

@ryantm That won't be true in the upgraded nixmodules -- that is the case today, and our goal is to effectively have a noop through this upgrade

[blast-hardcheese]

@airportyh if pip is on PATH but pip is not in PYTHONPATH then pip is broken anyway