Backport of secp256k1#901
Main change is moving away from nix-shell to a regular debian docker.
The commit
https://github.com/bitcoin-core/secp256k1/pull/901/commits/c7f754fe4d5e032fd150c4b9b985855e9fcaa521
has not been ported since it is not relevant for us.
Depends on D9397.