Add Nix flake for mciasctl and mciasgrpcctl

Vendor dependencies and expose control program binaries via
nix build. Uses nixpkgs-unstable for Go 1.26 support.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vendor/github.com/google/go-tpm/tpm2/create_salt.go

@@ -0,0 +1,14 @@
+package tpm2
+
+import "io"
+
+var (
+	labelSecret = "SECRET"
+)
+
+// CreateEncryptedSalt encrypts a random salt for secure session establishment.
+func CreateEncryptedSalt(rand io.Reader, pub LabeledEncapsulationKey) (salt []byte, encSecret []byte, err error) {
+	// The salt value is directly used from the Labeled Key Encapsulation operation.
+	// See Part 1, "Salted and Bound Session Key Generation"
+	return pub.Encapsulate(rand, labelSecret)
+}