New opam-based CI and build system

Submodules are gone. If you have opam set up, `make build-dep` will install the right version of everything.

This is *not* exactly what we discussed last week; I think I found something better. In particular, this approach lets us also figure out for historic lambdaRust versions, which commit of iris they needed. No magic branches in other repositories are needed, everything is local here.

Essentially, since the `opam` files do not support documenting detailed enough version information, I added a new file `opam.pins` that "enhances" the opam file appropriately. This file contains pins (one per line) that have to be set to compile lambdaRust. The script in `build/opam-pins.sh` applies those pins - and crucially, it does so recursively: When it finds a pin that is one of our git repositories, it will download the `opam.pins` files for *that* commit and also apply its pins. So if lambdaRust pins a particular commit of iris, and iris pins a particular commit of the prelude, then doing `make build-dep` in lambdaRust will follow this transitive chain and install the correct versions of iris and the prelude.

Cc @jjourdan @robbertkrebbers

See merge request !2