feat(nix-based): Rootless usage

[tulilirockz]

We could add a tag for user-only operations, requiring only FUSE support to work. Cache directories can be rewired to be on specific user paths, so that is not an issue, but the mounting requires rootful access, because we use syscall.Mount, and syscall.Unmount to make it work, but we can require the target machite to have fuse-overlayfs and maybe bindfs to completely make the mounting rootless