netns-isolation: netns architecture

- Adds network namespace instantiation and routing architecture.
- netns-isolation disabled by default. Can be enabled with
  configuration.nix FIXME.
- Uses mkMerge to toggle certain options for non netns and netns
  systems.
- Adds security wrapper for netns-exec which allows operator to exec
  with cap_sys_admin
- User can select the 169.254.N.0/24 addressblock netns's are created in.
- nix-bitcoin-services IpAddressAllow is amended with link-local
  addresses

modules/modules.nix

@@ -14,6 +14,7 @@
     ./hardware-wallets.nix
     ./lnd.nix
     ./secrets/secrets.nix
+    ./netns-isolation.nix
   ];
 
   disabledModules = [ "services/networking/bitcoind.nix" ];