nixos: improve grsecurity module, round #1

In a nutshell:

  - sysctl's can now be null
    - they won't be put in systemd-sysctl's configuration if the value
      is null
    - kptr_restrict is properly disabled when the grsec module is
      enabled
  - Improve naming of various options
  - Typos
  - Turn on AppArmor module
  - Embed revisions inside grsec kernel versions (this might be
    temporary, but I find it useful to track).

Signed-off-by: Austin Seipp <aseipp@pobox.com>