autofirma: init at 1.9

[vendul0g]

Description of changes

Adds autofirma, the desktop electronic signature client of the Spanish
Government (Cliente @firma suite). It is required to sign documents and complete
procedures with Spanish public administrations, most of which only accept
signatures performed with AutoFirma.

The package repackages the official Debian release binaries from
https://firmaelectronica.gob.es/Home/Descargas.html. The archive contains
binary JARs only (no native code), reflected in
sourceProvenance = binaryBytecode.

Packaging notes:

• The JARs look for NSS libraries under /usr/lib/firefox*; a small
  runCommand exposes nixpkgs' nss/nspr under that path inside a
  buildFHSEnv environment, so the JARs need no patching.
• AutoFirma must write autofirma.pfx next to its JARs, which is impossible
  in the read-only Nix store, so the wrapper copies the JARs to
  ~/.local/share/autofirma on first run (re-copied when the package version
  changes).
• An extra autofirma-setup wrapper runs AutoFirmaConfigurador and installs
  the AutoFirma root certificate into every detected NSS database. This is
  required on NixOS, where Firefox keeps its profiles under
  ~/.config/mozilla/firefox/ instead of the ~/.mozilla/firefox/ path the
  configurator assumes; without it, Firefox rejects AutoFirma's secure
  WebSocket.
• Each upstream release is published under a versioned directory
  (.../descargas-software/autofirma19/...), which keeps the source URL stable
  and trackable. Older releases (≤ 1.8.3) live in unversioned URLs.

AI disclosure: this PR was prepared with the assistance of the opencode agent
(GLM-5.3). All changes were reviewed by the submitter, who ran and verified the
application, and validated with local builds, passthru.tests, treefmt and
nixpkgs-vet. The commit messages carry the required Assisted-by: trailers.

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.
• Follows the automation/AI policy.