nixos/fail2ban: allow overriding the default jails

This allows users to set their own services.fail2ban.jails.DEFAULT
settings (and customizing, or even disabling, the currently
always-enabled ssh filter).