By default, the dependabot CLI fetches the latest versions of two images
it depends on, with the underlying assumption that the CLI is also a recent version.
This of course causes problems if the CLI is outdated and doesn't
support the latest images.
This commit introduces a separate wrapper binary that pins these images
to the latest version of them at the time of updating.
The nixpkgs-unstable channel's programs.sqlite was used to identify
packages producing exactly one binary, and these automatically added
to their package definitions wherever possible.
