Nix: Fix the build inputs for the shell and app.

This makes a few changes to the Nix flake to get things building on my
machine.

1. On macOS, add `CoreFoundation` to the list of dependencies.
2. Remove `pkg-config`; we don't seem to need it.
3. Move `protobuf` to `nativeBuildInputs` as it's required at runtime.
4. Reuse inputs from the default package in the shell.

The last point is partially undoing a change I made earlier, where the
shell brought in inputs from all flake checks. This was way too broad;
this narrows it a lot.

flake.nix

@@ -83,13 +83,15 @@
         formatter = pkgs.nixpkgs-fmt;
 
         devShells.default = pkgs.mkShell {
+          # include dependencies of the default package
+          inputsFrom = [ self.packages.${localSystem}.default ];
+
           # build-time inputs
           nativeBuildInputs = [
             # Development
             pkgs.just
             pkgs.nixpkgs-fmt
             pkgs.nodePackages.prettier
-            pkgs.pkg-config
 
             # Rust
             pkgs.cargo-edit
@@ -108,12 +110,6 @@
             # Deployment
             pkgs.skopeo
           ];
-
-          # runtime inputs
-          buildInputs = [
-            pkgs.openssl
-            pkgs.protobuf
-          ];
         };
 
         # This performance-testing shell will only work on Linux.

nix/app.nix

@@ -24,18 +24,18 @@ let
       in
       lib.cleanSourceWith { src = craneLib.path ./..; filter = isSourceFile; };
 
+    strictDeps = true;
+
     buildInputs = [
-      openssl
+      openssl # required for TLS connection to PostgreSQL
+      protobuf # required by opentelemetry-proto, a dependency of axum-tracing-opentelemetry
     ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # macOS-specific dependencies
       libiconv
+      darwin.apple_sdk.frameworks.CoreFoundation
       darwin.apple_sdk.frameworks.Security
       darwin.apple_sdk.frameworks.SystemConfiguration
     ];
-
-    nativeBuildInputs = [
-      pkg-config # required for non-static builds
-      protobuf # required by opentelemetry-proto, a dependency of axum-tracing-opentelemetry
-    ];
   };
 
   # Build the dependencies first.