nix-ssh-serve.nix: Remove unnecessary check

ForceCommand ensures that we always run nix-store --serve, so there is
no need to check SSH_ORIGINAL_COMMAND.
Add convenience option nix.sshServe.keys

This is equivalent to setting
users.extraUsers.nix-cache.openssh.authorizedKeys.keys.
nix-ssh: Don't use a shell that refers to a store path
setup-etc.pl: Keep track of copied files

We now track copied files in /etc/.clean. This is important, because
otherwise files that are removed from environment.etc will not
actually be removed from the file system. In particular, changing
users.extraUsers.<user>.openssh.authorizedKeys.keys to an empty list
would not cause /etc/ssh/authorized_keys.d/<user> to be removed, which
was a security issue.