third_party/nix: fix heredoc interpolation

This is a bit cursed as we have a bash script inside a Nix multi-line
string writing another bash script via a heredoc. The dirname expression
is currently being evaluated by bash while writing the inner script as
$( is interpolated in a bash heredoc. Quote it by both layers to prevent
this.

Previously in bin/bazel:
    workspace_dir="."
With this fix:
    workspace_dir="$(dirname "${workspace_dir}")"

Change-Id: I6e820faf222b1f364ea1b9e1a590e56ace4a638e
Reviewed-on: https://review.monogon.dev/c/monogon/+/2835
Tested-by: Jenkins CI
Reviewed-by: Tim Windelschmidt <tim@monogon.tech>
diff --git a/third_party/nix/env.nix b/third_party/nix/env.nix
index 6dcd6f8..4ba3a49 100644
--- a/third_party/nix/env.nix
+++ b/third_party/nix/env.nix
@@ -61,7 +61,7 @@
               readonly workspace_dir
               return
             fi
-            workspace_dir="$(dirname "\''${workspace_dir}")"
+            workspace_dir="\''$(dirname "\''${workspace_dir}")"
           done
           readonly workspace_dir=""
         }