Add Nix flake for mciasctl and mciasgrpcctl

Vendor dependencies and expose control program binaries via
nix build. Uses nixpkgs-unstable for Go 1.26 support.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vendor/github.com/go-webauthn/webauthn/protocol/base64.go

@@ -0,0 +1,52 @@
+package protocol
+
+import (
+	"bytes"
+	"encoding/base64"
+	"reflect"
+)
+
+// URLEncodedBase64 represents a byte slice holding URL-encoded base64 data.
+// When fields of this type are unmarshalled from JSON, the data is base64
+// decoded into a byte slice.
+type URLEncodedBase64 []byte
+
+func (e URLEncodedBase64) String() string {
+	return base64.RawURLEncoding.EncodeToString(e)
+}
+
+// UnmarshalJSON base64 decodes a URL-encoded value, storing the result in the
+// provided byte slice.
+func (e *URLEncodedBase64) UnmarshalJSON(data []byte) error {
+	if bytes.Equal(data, []byte("null")) {
+		return nil
+	}
+
+	// Trim the leading and trailing quotes from raw JSON data (the whole value part).
+	data = bytes.Trim(data, `"`)
+
+	// Trim the trailing equal characters.
+	data = bytes.TrimRight(data, "=")
+
+	out := make([]byte, base64.RawURLEncoding.DecodedLen(len(data)))
+
+	n, err := base64.RawURLEncoding.Decode(out, data)
+	if err != nil {
+		return err
+	}
+
+	v := reflect.ValueOf(e).Elem()
+	v.SetBytes(out[:n])
+
+	return nil
+}
+
+// MarshalJSON base64 encodes a non URL-encoded value, storing the result in the
+// provided byte slice.
+func (e URLEncodedBase64) MarshalJSON() ([]byte, error) {
+	if e == nil {
+		return []byte("null"), nil
+	}
+
+	return []byte(`"` + base64.RawURLEncoding.EncodeToString(e) + `"`), nil
+}