deployment: Correctly merge physical specs.

We used mergeAttrByFunc before, but it turned out that this is not what
we want (it actually does some mix between recursiveUpdate and //,
overwriting sub-attributes!). So we are now using the module system for
merging and put the resource-specific physical specification into a
nested require = [builtins.toFile filename ...]; while escaping the
values according to the Nix string escaping rules.

This also makes the implementation less error-prone if the
implementation of mergeAttrByFunc should change someday (because it's
used only once in <nixpkgs>).

Of course, if the underlying implementation of the module system or Nix
itself changes, we should be affected as well, but that should be an
entirely different beast ;-)

Signed-off-by: aszlig <aszlig@redmoonstudios.org>