Adds a shell script that supports a subset of the 'pass' interface for
compatibility with kontemplate, and wraps kontemplate in a script that
places this version on the PATH.
This makes it possible to use Cloud KMS encrypted secrets with kontemplate.
Initial version of tool provider via Nix. This requires two separate
steps for adding a new tool:
1. New symlink in tools/bin to point at the dispatch script.
2. Mapping of tool to Nix package set attribute in dispatch script.