Don't reboot a container when its configuration changes

Instead, just run "switch-to-configuration" inside the container.
Give containers a writable /nix/var/nix/{profiles,gcroots}

These are stored on the host in
/nix/var/nix/{profiles,gcroots}/per-container/<container-name> to
ensure that container profiles/roots are not garbage-collected.
Add support for running a container with a private network interface

For example, the following sets up a container named ‘foo’.  The
container will have a single network interface eth0, with IP address
10.231.136.2.  The host will have an interface c-foo with IP address
10.231.136.1.

  systemd.containers.foo =
    { privateNetwork = true;
      hostAddress = "10.231.136.1";
      localAddress = "10.231.136.2";
      config =
        { services.openssh.enable = true; };
    };

With ‘privateNetwork = true’, the container has the CAP_NET_ADMIN
capability, allowing it to do arbitrary network configuration, such as
setting up firewall rules.  This is secure because it cannot touch the
interfaces of the host.

The helper program ‘run-in-netns’ is needed at the moment because ‘ip
netns exec’ doesn't quite do the right thing (it remounts /sys without
bind-mounting the original /sys/fs/cgroups).
Ensure that the container root can always be accessed via /var/lib/containers
Add command ‘nixos-container-shell’ for logging into a container
Don't run dhcpcd in containers
Fix permissions
Merge master into x-updates
libxklavier: update 5.0 -> 5.3 (after a long time)
xorg: update, regenerate (new: glamor-egl)

Updates caught by nixpkgs monitor.
xorg: fixup after the update

All that built before update builds now again (and glamor-egl is new).
nixos ati: support glamor, disabled by default

This is from @ambrop72 #1969.
mesa: major update to 10.0.4, seems to work finally
gtk2: bugfix update 2.24.22 -> .23
harfbuzz: minor update 0.9.26 -> .27
xorg.libFS: maintenance update 1.0.5 -> .6
automake: update from 1.12.4 to 1.12.6
Merge branch master into x-updates (fix eval)
libjpeg(_turbo): minor update 1.3.0 -> .1

The security patch got incorporated into the release.
mesa: add symlinks from $out/lib/*.so to $drivers/lib

This is mainly in order for libGL to be present in /run/opengl-drivers{,-32}.
Now even with mesa drivers pkgs will use your current nixos libGL
instead of the one it was built against.

Thanks to @iElectric for suggesting this change.