dockerTools: fix absent /proc during runAsRoot

[thefloweringash]

The chroot environment under mnt had /dev and /sys via bind mounts,
but nothing setting up /proc. The --mount-proc argument to unshare
defaults to /proc, which is outside of the chroot envirnoment.

Motivation for this change

A recent combination of coreutils/glibc seems to rely on /proc during copy for some edge cases, for example, copying a readonly directory. This use case can occur when copying from the store. Motivating test cases:

let
  pkgs = import <nixpkgs> {};

  testScript = ''
    set -x
    [ -e /proc/mounts ] && cat /proc/mounts
    cd /
    id
    pwd
    mkdir -p a/b
    chmod 555 -R a
    cp -r a a2
    set +x
  '';
in
{
  vm = pkgs.vmTools.runInLinuxVM (
    pkgs.runCommand "test-run-in-linux-vm" {} testScript
  );

  dockerWithProc = pkgs.dockerTools.buildImage {
    name = "test-docker-with-proc";
    runAsRoot = ''
      [ -e /proc/mounts ] || ${pkgs.utillinux}/bin/mount -t proc proc /proc
    '' + testScript;
  };

  dockerWithoutProc = pkgs.dockerTools.buildImage {
    name = "test-docker-without-proc";
    runAsRoot = testScript;
  };
}

On current master, vm and dockerWithProc should build while dockerWithoutProc should fail with:

cp: setting permissions for 'a2': Operation not supported

After this change, all cases are expected to pass.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.