This changes how the templates use nixpkgs. Before, we instantiated
nixpkgs in the flake and passd it directly to the configs; this was good
for consistency, but silently ignored `nixpkgs.*` options, generating
confusion among users. We now use modules to configure nixpkgs.
This should help avoid cases such as:
https://discourse.nixos.org/t/allowunfree-doesnt-work-with-flake-managed-system/21798/17
The drawback is that we can no longer test overlayed packages like so:
`nix build .#foo`, you can do it like so instead: `nix build
.#nixosConfigurations.your-system.pkgs.foo`.
Personally, I've been avoiding override packages globally in my own
config.
