Ship a nixos module for registering oci-container sidecars

[antifuchs]

Since tsnsrv is available as a docker image, it would be great if we could integrate that in nixos as well! (Can you tell I run a few oci-containers in a nixos host that would benefit from a sidecar?)

This requires a few steps:

• An automated step similar to the SRI/narhash update workflow that will pull the image with nix-prefetch-docker and updates a pinned docker reference defining a dockerContainers attribute on the flake.nix, which builds an image containing tsnsrv.
• The actual module. It should take:
  • The regular tsnsrv customization options
  • A container to sidecar the tsnsrv container to (i.e. share network namespace with)
  • An optional docker image spec, defaulting to what we generate above.