nixos/tests/netbox-upgrade: don't require NIXPKGS_ALLOW_INSECURE

Before this change, this NetBox test required NIXPKGS_ALLOW_INSECURE=1,
because of its use of the end-of-line NetBox version.
This meant that the GitHub CI failed to evaluate the tests,
and so didn't run them.

nixos/tests/web-apps/netbox-upgrade.nix

···
 import ../make-test-python.nix (
   { lib, pkgs, ... }:
   let
-    oldNetbox = pkgs.netbox_4_1;
-    newNetbox = pkgs.netbox_4_2;
+    oldNetbox = "netbox_4_1";
+    newNetbox = "netbox_4_2";
+
+    apiVersion =
+      version:
+      lib.pipe version [
+        (lib.splitString ".")
+        (lib.take 2)
+        (lib.concatStringsSep ".")
+      ];
+    oldApiVersion = apiVersion pkgs."${oldNetbox}".version;
+    newApiVersion = apiVersion pkgs."${newNetbox}".version;
   in
   {
     name = "netbox-upgrade";
···
     };
 
     nodes.machine =
-      { config, ... }:
+      { config, pkgs, ... }:
       {
         virtualisation.memorySize = 2048;
         services.netbox = {
           enable = true;
-          package = oldNetbox;
+          # Pick the NetBox package from this config's "pkgs" argument,
+          # so that `nixpkgs.config.permittedInsecurePackages` works
+          package = pkgs."${oldNetbox}";
           secretKeyFile = pkgs.writeText "secret" ''
             abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
           '';
···
 
         networking.firewall.allowedTCPPorts = [ 80 ];
 
-        specialisation.upgrade.configuration.services.netbox.package = lib.mkForce newNetbox;
+        nixpkgs.config.permittedInsecurePackages = [ pkgs."${oldNetbox}".name ];
+
+        specialisation.upgrade.configuration.services.netbox.package = lib.mkForce pkgs."${newNetbox}";
       };
 
     testScript =
       { nodes, ... }:
-      let
-        apiVersion =
-          version:
-          lib.pipe version [
-            (lib.splitString ".")
-            (lib.take 2)
-            (lib.concatStringsSep ".")
-          ];
-        oldApiVersion = apiVersion oldNetbox.version;
-        newApiVersion = apiVersion newNetbox.version;
-      in
       ''
         start_all()
         machine.wait_for_unit("netbox.target")