Make ca-derivations require a `ca-derivations` machine feature, and
ca-aware builders expose it.

That way, a network of builders can mix ca-aware and non-ca-aware
machines, and the scheduler will send them in the right place.

This was

 - Added in dbf96e10.

 - Commented out in 07975979, which I
   believe only reached master by mistake.

 - Deleted in c32168c9, when
   `tests/build-hook-ca.nix` was reused for a new test.

But the test works, and we ought to have it.