Similar to the colocated `substituteAll` script and derivation, this
PR adds nix-level support for `substitute` directly. This is useful,
for instance, to be able to easily make tweaks to patch files for an
existing derivation's existing patch files.
