Containers: Use /etc/resolv.conf supplied by the host

This used to work with systemd-nspawn 203, because it bind-mounted
/etc/resolv.conf (so openresolv couldn't overwrite it). Now it's just
copied, so we need some special handling.
Remove long-obsolete /nix/var/nix/chroots directory
Put /nix/var/nix/{temproots,userpool} on a tmpfs
Containers: Don't warn about not having a boot loader
Use "machinectl poweroff" to shut down containers
postgresql: Use systemd's new "mixed" kill mode

"Mixed" mode sends the initial SIGINT only to the main process, but
sends the SIGKILL after the time-out expires to the entire cgroup.
ssh-agent: Tweaks
Fix broken upstream user unit symlinks