p7zip: vendor debian patches

A few months ago I moved these patches to the new debian alsa instance [1], but
it looks like their `sha256`s on the tag at the remote have changed again.

It doesn't appear that debian's source remote is stable in the way we need it to
be; let's just vendor the patches to avoid future issues.

[1] https://github.com/NixOS/nixpkgs/pull/41769

pkgs/tools/archivers/p7zip/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch }:
+{ stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   name = "p7zip-${version}";
@@ -10,16 +10,8 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (fetchpatch rec {
-      name = "CVE-2016-9296.patch";
-      url = "https://salsa.debian.org/debian/p7zip/raw/debian/${version}+dfsg-6/debian/patches/12-${name}";
-      sha256 = "09wbkzai46bwm8zmplsz0m4jck3qn7snr68i9p1gsih300zidj0m";
-    })
-    (fetchpatch rec {
-      name = "CVE-2017-17969.patch";
-      url = "https://salsa.debian.org/debian/p7zip/raw/debian/${version}+dfsg-6/debian/patches/13-${name}";
-      sha256 = "00pycdwx6gw7w591bg54ym6zhbxgn47p3zhms6mnmaycfzw09mkn";
-    })
+    ./12-CVE-2016-9296.patch
+    ./13-CVE-2017-17969.patch
   ];
 
   # Default makefile is full of impurities on Darwin. The patch doesn't hurt Linux so I'm leaving it unconditional