ci/lint: explicitly define substituters

This means we don't need to rely on `--accept-flake-config`, which could
be problematic if we switch from `pull_request` -> `pull_request_target`

Author: MattSturgeon

.github/workflows/lint.yml

@@ -20,5 +20,10 @@ jobs:
         uses: actions/checkout@v4
       - name: Install Nix
         uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            extra-substituters = https://nix-community.cachix.org
+            extra-trusted-public-keys = nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
+
       - name: Run treefmt check
-        run: nix build .#checks.x86_64-linux.treefmt --accept-flake-config
+        run: nix build .#checks.x86_64-linux.treefmt