Merge 'master' into x-updates
mesa: major update 10.0.4 -> 10.1.1
xorg: minor updates of three packages
xorg-server: major update 1.14.5 -> 1.15.1
xorg: revert fontsproto update, as it breaks libXfont

This partially reverts commit 30ac332563318be4e445dc3335e803326df84d3c.
https://groups.google.com/forum/#!msg/xorg-devel/SvgqiQnSN7c/f0wjRhauqvUJ

It's sad that the currently *released* versions don't even compile together,
and no dev reacts for four days so far...
xorg-server: go back to 1.14.6 due to intel problems

Again, stable releases not compiling together :-/
Add expression for cabal-install 1.20.0.0
Fix icu4c expression for latest gcc (fixes #2341)
Updated OCaml package findlib
Updated OCaml package pcre
Ignore *.wants in systemd.packages for now
dbus: Use upstream units
sshd: Always start a session

Partially reverts 70a4c7b1dfdb238d3729c3f71127538943a43afd. Whether to
start a session is independent of whether we're running in a
container.
dbus: Merge tools and daemon

This resolves a cyclic dependency: the daemon depends on tools (for
dbus-send) while tools depends on the daemon.  Keeping them separate
doesn't seem very useful in any case.
sshd: Add support for socket activation

By enabling ‘services.openssh.startWhenNeeded’, sshd is started
on-demand by systemd using socket activation. This is particularly
useful if you have a zillion containers and don't want to have sshd
running permanently. Note that socket activation is not noticeable
slower, contrary to what the manpage for ‘sshd -i’ says, so we might
want to make this the default one day.
Typo/comment
nixos: evaluate assertions at toplevel, not at systemPackages

Fixes #2340
gdk-pixbuf: check for writable $out/.., closes #2115
Add expression for sage
wireshark: build with libcap (POSIX capabilities)

This makes running wireshark (or more specifically, dumpcap) as root a
bit more secure. From <wireshark-1.11.2>/doc/README.packaging:

  The "--with-libcap" option is only useful when dumpcap is installed
  setuid. If it is enabled dumpcap will try to drop any setuid privileges
  it may have while retaining the CAP_NET_ADMIN and CAP_NET_RAW
  capabilities. It is enabled by default, if the Linux capabilities
  library (on which it depends) is found.