nixos: add grsecurity module (RFC)

This module is a work-in-progress which refactors grsecurity support into a module, which can be easily enabled from a users `configuration.nix`.

There are a few reasons for doing this: the current way of enabling grsec support is incredibly un-nix like, as it requires choosing a kernel package and then appropriate options. This is error prone, and requires a lot of work for users when they really want an easy way to do it.

Second, grsec naturally encompasses some other things that can only be handled by a module, that are beyond the kernel package: in particular, mutable files must be installed appropriately into `/etc/grsec` (as `gradm` will use/update the policy files). There are also needed udev rules for `/dev/grsec`. Furthermore, some options like `GRKERNSEC_CHROOT_CHMOD` are extremely incompatible with Nix, and make it impossible to install software. So by default, the module disables this (although it works great if you deploy with NixOps).

Also, some options are incompatible in other ways: for example, `GRKERNSEC_RANDSTRUCT` breaks the virtualbox guest networking drivers (a bug I need to send to grsec upstream), and `GRKERNSEC_LINK` breaks on the 3.13.5 testing kernel (but not the 3.2 stable kernel). Also, if you disable `sysctl` support, things like `systemd-sysctl` must be disabled as they won't work.

Overall, having a module take care of this means there's a lot less pain. This module naturally takes control of `boot.kernelPackages` - I'm not sure how much precedent there is for that, but I think it's reasonable given the purpose.

This also moves the grsecurity overrides out of the kernel package and into the module itself, leaving only the patches in `pkgs`, which I think is probably where it belongs anyway.

Finally, as the grsecurity patches imply `config.apparmor=true`, the module also turns apparmor on as the patches are included (which is easily overlooked).

This is my first 'big' NixOS module that's not simply a service, so I'd appreciate input. If we can land this in some form, more exciting work can happen soon, including enforcement/management of RBAC policies and userspace hardening.

Here's an example of enabling the configuration:

```
  security.grsecurity.enable  = true;
  #security.grsecurity.stable = true; # enable stable 3.2.55 kernel
  security.grsecurity.testing = true; # enable testing 3.13.5 kernel
  security.grsecurity.config = {
    mode     = "auto";
    priority = "security";
    system   = "server";
    virtualisationConfig     = "host";
    hardwareVirtualisation   = true;
    virtualisationSoftware   = "kvm";
 
    # Extra protection options
    denyChrootChmod   = true;
 
    # Extra kernel options
    kernelExtraConfig = ''
      DEVKMEM? n
      HIBERNATION? n
      XEN? n
      HYPERVISOR_GUEST? n
      KVM_GUEST? n
      PARAVIRT? n
    '';
  };
```

I'm using this configuration with NixOps, and am successfully deploying Linux 3.13.5-grsec onto Hetzner with this module.


There are some things left **TODO**:

  - [x] Enable AppArmor patches by default
  - [x] Enable AppArmor module by default
  - [ ] Automatically enable AppArmor configurations in modules by default.
    - So far, I think transmission is about the only one that does this.
    - We should review upstream apparmor configurations
  - [x] When first deployed with NixOps, `systemd.services.systemd-sysctl.enable` gets shadowed rather than cleanly disabled it appears, meaning I probably got this wrong somehow.
  - [x] Make sysctl options 'optional' (they will not appear in the `systemd-sysctl` config) if specified with `null`.
  - [x] Ensure `kptr_restrict` is `null` if grsecurity is enabled.
  - [x] Fix all option names
  - [x] Enable revision in module version.
    - Should probably be optional
    - Needs to override `./locaversion-grsec` after patching
  - [x] Properly detect virtualbox guest drivers to disable RANDSTRUCT.
  - [x] Abstract out the building of grsecurity patches
  - [x] Enable vserver patches
  - [ ] Fix kernel package configuration overrides
  - [x] Enable `grsec-lock` service for configurations that enable sysctl support
  - [ ] Enable a `gradm` module for RBAC control. Ideally most of this could be declarative.
  - [x] Fix configuration of `RANDSTRUCT` and `GRKERNSEC_LINKS`
  - [x] Make `common-config` kernel options optional
    - When using grsec, you often want to cut down the amount of stuff built (and it makes testing easier), so several of these things should be optional (e.g. I have no need for bluetooth, NFC, or many of the extra filesystems).

/cc @wizeman