Add a job to push merges to main to our public Cachix cache

[dhess]

Depends on #988.

Note that I considered just outright switching Primer CI to use our public Cachix cache for everything, not just merges to main. However, I think this would be a bad idea for a few reasons, including, but not limited to, the following:

• We probably don't want to push work-in-progress build artifacts to the public cache. For example, we might accidentally leak a secret while working on a PR, or inadvertently use a dependency that contains a vulnerability.
• Cachix caches don't grow unbounded, and most contributors won't care about work-in-progress build artifacts, so limiting the public cache to just the "final" artifacts will make better use of the available cache resources.

Instead, I think we can write a CI job that runs on every merge to main and pushes the Nix closure for main to the public cache.