Vicinae extension helpers always used importNpmLock, which reads package.json and package-lock.json during evaluation. When extension src comes from fetchgit or fetchFromGitHub, that forces Nix to realize the fetched source during eval and trips allow-import-from-derivation = false.
Accept npmDepsHash in mkExtension and mkRayCastExtension so fetched extension sources can use buildNpmPackage's fixed npm dependency fetcher path instead. Keep the existing importNpmLock behavior for local sources and document the hash requirement in the option example.
`literalExpression` is intended just to signify code that needs to stay
a string that gets represented exactly as-is for docs. It has been
misused heavily and people get confused repeatedly on when or not to use
it because of the rampant misuse.
