ci(nix): push Nix builds to a Cachix binary cache

Every Nix build of main and of each release tag now goes to
proton-drive-linux.cachix.org, so installing the flake downloads the
client instead of compiling it. The flake names the cache in nixConfig
for nix run and nix shell, and the install guide shows the nix.settings
a NixOS system build needs, since it does not read an input's
nixConfig. A fork's pull request has no token and only pulls.

.github/workflows/nix.yml

@@ -38,6 +38,13 @@ jobs:
 
       - uses: cachix/install-nix-action@v31
 
+      # Pulls from the project's binary cache, and pushes what this run built
+      # when the token is there; a fork's pull request has none and only pulls.
+      - uses: cachix/cachix-action@v17
+        with:
+          name: proton-drive-linux
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
       - name: Check the flake
         run: nix flake check --print-build-logs --no-build