Provide non-flake hermetic shell by pinning nixpkgs (#23368)

Provide non-flake solution by pinning in shell.nix

Invoking `nix-shell` makes shell.nix not consume the flake. Importing
`<nixpkgs>` is dependent on the user's current nixpkgs channel. This is not
reproducible.

Fix this by pinning nixpkgs to the same revision of the flake input.

flake.lock

@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1702780907,
+        "lastModified": 1704172037,
-        "narHash": "sha256-blbrBBXjjZt6OKTcYX1jpe9SRof2P9ZYWPzq22tzXAA=",
+        "narHash": "sha256-+IkG0mfxwmaqCd3cGM5zZ2g7wZnPG8mwOQHXCsKhc5s=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1e2e384c5b7c50dbf8e9c441a9e58d85f408b01f",
+        "rev": "3da785eeaad3d604ee3bccc0a3f07bfd11cb355a",
         "type": "github"
       },
       "original": {

shell.nix

@@ -1,4 +1,8 @@
-{ pkgs ? import <nixpkgs> {} }:
+{ pkgs ? import (builtins.fetchTarball {
+  url =
+    "https://github.com/NixOS/nixpkgs/archive/3da785eeaad3d604ee3bccc0a3f07bfd11cb355a.tar.gz";
+  sha256 = "16vkl710mmq176qcj6ygk70kns37fg71ip6x16m6dhpicz90d2gq";
+}) { } }:
 
 let
   dependencies = with pkgs; [