Changelog: build-time flake inputs and unauthenticated upgrades

Determinate Nix introduces a new type of flake input for sources and `determinate-nixd upgrade` now works without logging in.