fail2ban: move /var/run/fail2ban creation to activation script to be able to restrict the write locations for the service properly, add configuration files to the restartTriggers.
Fix node_modules references in uptime module.
Use the qemu-kvm wrapper
bash: Disable hashing of command lookups in interactive shells

This just confuses people when (say) using multiple profiles.
Performance benefits for interactive shells are likely to be very
small anyway.
Support Nix's mandatoryFeatures

Extend the buildMachines option to support specification of
supportedFeatures and mandatoryFeatures in order to support all
configuration options of the nix.machines file.
Hide kernel pointers for unprivileged users via kptr_restrict
Generate /etc/passwd and /etc/group at build time

This is a rather large commit that switches user/group creation from
using useradd to just generating the contents of /etc/passwd and /etc/group,
and then on activation merging the generated files with the files that exist in
the system. This makes the user activation process much cleaner, in my opinion.

The users.extraUsers.<user>.uid and users.extraGroups.<group>.gid must all be
properly defined (if <user>.createUser is true, which is by default). My pull
request adds a lot of uids/gids to config.ids to solve this problem for
existing nixos services, but there might be configurations that break because
this change. However, this will be discovered during the build.

The commit removes the options <user>.isSystemUser and <user>.isAlias since
they don't make sense when generating /etc/passwd. It adds <group>.members as a
complement to <user>.extraGroups and <user>.passwordFile for setting a user's
password from an encrypted (shadow-style) file. It also adds users.mutableUsers
which is false by default. If set to true, the generated passwd and group
files will not be merged with the system files on activation. Instead they will
simply replace the system files.

The merging of the files is simplistic. It just looks at the user/group names.
If a user/group exists both on the system and in the generated files, the
system entry will be kept un-changed and the generated entries will be ignored.
The merging itself is performed with the help of vipw/vigr to properly lock
the account files during edit.

I have tested this on a couple of different systems and it seems to work fine
so far. If you think this is a good idea, please test it. This way of adding
local users has been discussed in issue #103 (and this commit solves that
issue).