CI: move the NSS job from zuul to GHA

Closes #8396

.github/workflows/nss.yml

@@ -0,0 +1,50 @@
+name: Linux
+
+on:
+  # Trigger the workflow on push or pull requests, but only for the
+  # master branch
+  push:
+    branches:
+    - master
+    - '*/ci'
+  pull_request:
+    branches:
+    - master
+
+jobs:
+  autotools:
+    name: ${{ matrix.build.name }}
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+        - name: NSS
+          install:
+          configure: --with-nss --enable-debug --enable-werror
+
+    steps:
+    - run: |
+        sudo apt-get install libtool autoconf automake pkg-config stunnel4 python3-pip libnss3-dev clang-9 libpsl-dev libbrotli-dev libzstd-dev libnghttp2-dev nss-plugin-pem
+        sudo pip3 install impacket
+      name: install prereqs and impacket
+
+    - uses: actions/checkout@v2
+
+    - run: ./buildconf
+      name: 'buildconf'
+
+    - run: CC=clang-9 CPPFLAGS="-isystem /usr/include/nss" ./configure ${{ matrix.build.configure }}
+      name: 'configure with clang'
+
+    - run: make V=1
+      name: 'make'
+
+    - run: make V=1 examples
+      name: 'make examples'
+
+    - run: make V=1 test-ci
+      name: 'test'
+      env:
+        TFLAGS: "${{ matrix.build.tflags }}"