ci/update-pinned.sh: use nixpkgs from current dir, run npins upgrade too

Use nixpkgs from the current directory because otherwise the npins used
could be outdated.

Also run npins upgrade as part of the script.

ci/update-pinned.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p npins
+#!nix-shell -i bash -p npins -I nixpkgs=../
 
 set -euo pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
+npins --lock-file pinned.json upgrade
 npins --lock-file pinned.json update