Nix: update pinned tag refs in `flake.nix`

[JamieMagee]

Is there an existing issue for this?

• I have searched the existing issues

Feature description

When a flake.nix input pins to a specific tag, Dependabot should detect newer tags and update the ref.

# before
inputs.devenv.url = "github:cachix/devenv/v0.5";

# after
inputs.devenv.url = "github:cachix/devenv/v0.5.1";

The PR would also regenerate flake.lock, which we already know how to do.

This is the second use case from #7340. We left it out of #14498 because it means parsing Nix syntax to find and rewrite URL strings in flake.nix. The lock file part is the easy bit.

Things to figure out:

• Parsing. Nix syntax is not trivial to parse from Ruby, but input URLs follow a pretty predictable pattern. A regex over the raw file might be enough for common cases.
• Tag ordering. Most flake inputs use semver-ish tags, but not all. What do we do with non-semver tags? Skip them? Treat any different tag as newer?

[euphemism]

On the subject of devenv (from the above example), it would be great if you could also support devenv.lock files which are essentially equivalent to a flake.lock as far as I am aware. @domenkozar would be able to provide specifics.

[JamieMagee]

@euphemism (or @domenkozar) would you be able to create a separate issue to track devenv support?

I'm closing this out now #14710 is merged and deployed.