Put functional tests in `tests/functional`

I think it is bad for these reasons when `tests/` contains a mix of
functional and integration tests

 - Concepts is harder to understand, the documentation makes a good
   unit vs functional vs integration distinction, but when the
   integration tests are just two subdirs within `tests/` this is not
   clear.

 - Source filtering in the `flake.nix` is more complex. We need to
   filter out some of the dirs from `tests/`, rather than simply pick
   the dirs we want and take all of them. This is a good sign the
   structure of what we are trying to do is not matching the structure
   of the files.

With this change we have a clean:
```shell-session
$ git show 'HEAD:tests'
tree HEAD:tests

functional/
installer/
nixos/
```

(cherry picked from commit 68c81c737571794f7246db53fb4774e94fcf4b7e)

1 files changed, 56 insertions, 0 deletions

diff --git a/tests/functional/hermetic.nix b/tests/functional/hermetic.nix
new file mode 100644
index 000000000..4c9d7a51f
--- /dev/null
+++ b/tests/functional/hermetic.nix
@@ -0,0 +1,56 @@
+{ busybox, seed }:
+
+with import ./config.nix;
+
+let
+  contentAddressedByDefault = builtins.getEnv "NIX_TESTS_CA_BY_DEFAULT" == "1";
+  caArgs = if contentAddressedByDefault then {
+    __contentAddressed = true;
+    outputHashMode = "recursive";
+    outputHashAlgo = "sha256";
+  } else {};
+
+  mkDerivation = args:
+    derivation ({
+      inherit system;
+      builder = busybox;
+      args = ["sh" "-e" args.builder or (builtins.toFile "builder-${args.name}.sh" "if [ -e .attrs.sh ]; then source .attrs.sh; fi; eval \"$buildCommand\"")];
+    } // removeAttrs args ["builder" "meta" "passthru"]
+    // caArgs)
+    // { meta = args.meta or {}; passthru = args.passthru or {}; };
+
+  input1 = mkDerivation {
+    shell = busybox;
+    name = "hermetic-input-1";
+    buildCommand = "echo hi-input1 seed=${toString seed}; echo FOO > $out";
+  };
+
+  input2 = mkDerivation {
+    shell = busybox;
+    name = "hermetic-input-2";
+    buildCommand = "echo hi; echo BAR > $out";
+  };
+
+  input3 = mkDerivation {
+    shell = busybox;
+    name = "hermetic-input-3";
+    buildCommand = ''
+      echo hi-input3
+      read x < ${input2}
+      echo $x BAZ > $out
+    '';
+  };
+
+in
+
+  mkDerivation {
+    shell = busybox;
+    name = "hermetic";
+    passthru = { inherit input1 input2 input3; };
+    buildCommand =
+      ''
+        read x < ${input1}
+        read y < ${input3}
+        echo "$x $y" > $out
+      '';
+  }