nixos/containerd: minor cleanup

[johanot]

Motivation for this change

Turns out that I initially misunderstood the containerd directory configurations. root is where containerd wants "persistent data" and state is where "runtime state" (ephemeral) lives. See: https://github.com/containerd/containerd/blob/master/docs/ops.md#base-configuration
I've changed directories to comply with systemd/nixos standards, i.e. /var/lib/containerd and /run/containerd respectively.

Also, systemd StartLimits must be in the [unit]-section, otherwise they are ignored. While moving them to unitConfig, I had to raise the limits to get reasonable startup times, now that start-limits are actually enforced. Feel free to raise opinions on restart-interval and start-limit values, because I chose the current ones rather arbitrarily, tbh.

NixOS tests run green locally with Kubernetes 1.20.5.

I'd like this to be part of release 21.05.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[johanot]

cc @saschagrunert @zowoq @ymatsiuk