hydra-eval-jobs: don't use restrict-eval for Flakes

[lheckemann]

Pure evaluation should cover all the uses for restrict-eval, and restrict-eval currently breaks accessing Git inputs on Flakes1.

[lheckemann]

Draft, because:

• I'm not 100% confident that there's nothing that works in pure-but-not-restricted eval but shouldn't work in the context of Hydra
• This results in Flake evals being able to access the local filesystem and arbitrary URLs if pure evaluation mode is disabled, which is a significant change from before

[lheckemann]

I think it's OK to do this. People disabling pure evaluation presumably have a good reason to do so.

[edolstra]

This does open up access to path flakes in the local file system (e.g. by having a flake input path:/foo/bar), see EvalState::checkURI().

[lheckemann]

In that case, I guess fixing NixOS/nix#7098 in Nix is the right approach to solving this problem.