nspawn: copy /dev/net/tun from host

This enables tuntap support in the container (assumning the necessary capabilities are in place).