Fix race in wait-for-file
defnixos: Separate activation from services
certs-activation: Generate a pkcs12 archive of cert + key
Remove blessed composition, generate pkcs12 in certs-activation, add strongswan-service, bug fixes

Many changes in one commit, put me on the wall of shame :(

Remove blessed composition: For now, there'll be no passing around of
big sets like pkgs and lib, no imports of nixpkgs, etc. inside of
defnix/defnixos. This requires explicitly passing the relevant arguments
to each package and function, which makes both external and
inter-dependencies clear. The eventual goal is to make it easy to make
surgical modifications to deployments, only changing exactly the
packages/functions we need to change. Eventually I expect common
compositions to arise, which we can abstract over when we know what
they'll look like.

generate pkcs12 in certs-activation: pkcs12 allows bundling a cert, key,
and CA chain into a single file, necessary for some tools that can't
extract multiple certs from a single PEM file (e.g. strongswan)

strongswan-service: peer-to-peer application-transparent secure ipsec
communication. Still one issue with the setup [1], and it depends on
upstream nixpkgs (I'll merge once everything's ready). Hopefully will
wrap this up ASAP.

bug fixes: Make activations target actually depend on activations
services, probably some other stuff thrown in there.

[1]: https://lists.strongswan.org/pipermail/users/2014-October/006709.html