Use nettle for sha1

This short series converts the debian packaging to use nettle in the normal .deb, in addition to statically linking against it in the .udeb.

In debian/patches, it adopts one change already merged upstream, so we should be able to drop that patch when the next upstream release lands in Debian.

By eliminating one build-dependency, we also reduce the runtime dependencies, thereby reducing the total installed base for an otherwise minimal debian system with the xorg xserver installed. (libnettle is already going to be available on debian systems because of apt's dependency on sqv)