Add a module for setting sysctl parameters

This adds an option ‘boot.kernel.sysctl’ and generates a file
/etc/sysctl/nixos.conf read by systemd-sysctl.service.
Enable hardlink and symlink restrictions

This prevents many time-of-check-time-of-use security bugs.  Ubuntu
enables these by default as well so they shouldn't cause many
problems.
installation-cd-base.nix: Use boot.kernel.sysctl