.github.ci: treat cache.lassul.us as upstream cache in hestia
With the lazy /nix/store in the machine jobs, hestia's drain read every
cache.lassul.us-only input path to mirror it into the GitHub Actions
cache, downloading 375-760 MiB per job through the lazy store and
spending 1-4.5 min uploading to the Actions cache at 2-11 MiB/s (PR 65
run). Those paths are already in cache.lassul.us; niks3 uploads
everything newly built.
upstream-cache-key-names replaces hestia's default list, so it repeats
cache.nixos.org-1 next to cache.lassul.us-1. In the eval job,
filter-drv-closures applies the same keys to the drv closures; members
signed by cache.lassul.us are substituted from there by the later jobs.