The new NIX_SSL_CERT_FILE changes break terraform (and probably other go projects) on Darwin

[copumpkin]

I just upgraded to Nix 1.11.7 and found that terraform breaks in a hard-to-track manner as a result. I think it's because all Go projects reimplement everything from scratch so none of our patches to standard HTTP libraries like curl affect it.

The tricky problem that arises is that each Go project pulls in its own full set of dependencies, often "vendored" right into the project repository, so there's no single place for us to patch the Go http libraries. I can fix Terraform in a one-off way since it's pretty painful, but we'll probably need a better solution to teach Go about NIX_CERT_FILE.

cc @edolstra @kamilchm

[kamilchm]

We can start with the patch for terraform and see if there's something that can be extracted to buildGoPackage or can be done as part of go2nix if we found that it can't be done in pure nix.

[copumpkin]

See #24058 which might fix it

[copumpkin]

Apparently it's not as tricky as I thought since crypto/x509 doesn't usually get vendored. Let's just hope that we never have to patch anything less central 😁

[LnL7]

Fixed by #27598