MachineState: Implement permissions for keys.

This however only implements setting permissions if "storeKeysOnMachine" is
set to false right now, because if the value is set to true the keys are
symlinked from the store and we actually have to find a way to control
permisions on it, which for the store is only possible if NixOS/nix#8 is
implemented.

Also, this ensures that the key filename is properly escaped.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Fix keyOptionsType submodule type.

First, forgot about specifying options.* and even if it would be there,
the option values wouldn't be merged because keyType was not properly
inheriting the merge function from keyOptionsType.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fix VM tests for hetzner and none backends.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 66aeeb201446a94f7ebb59461b5efcbc02019a9d)
tests: Add Archive::Cpio to all the coordinators.

This is needed in order to build the initrd for the target machines and
we don't have access to external network resources within the VM test.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 1bd7182bc1609d602e6193ee4665a6dce45aded4)
tests: Disable packet filtering on all VM tests.

This is only a source for more errors, confusion, more complexity and we
really don't want to test the packet filter here, because we already
have tests in NixOS directly.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 8feb9223bc5d43517bf4acd93b89a84802d90d05)