… derivations to new pullImage function signature

The extraCommands was, previously, simply put in the body of the script
using nix expansion `${extraCommands}` (which looks exactly like bash
expansion!).

This causes issues like in #34779 where scripts will eventually create
invalid bash.

The solution is to use a script like `run-as-root`.

 * * *

Fixes #34779

Skopeo used by our docker tools was patched to work in the build
sandbox (it used /var/tmp which is not available in the sandbox).
Since this temporary directory can now be set at build time, we remove
the patch from our docker tools.

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/criu/versions.

These checks were done:

- built on NixOS
- Warning: no invocation of /nix/store/31grlhm7igrgi29fhmndki41a8f87cvs-criu-3.9/bin/crit had a zero exit code or showed the expected version
- /nix/store/31grlhm7igrgi29fhmndki41a8f87cvs-criu-3.9/bin/compel passed the binary check.
- /nix/store/31grlhm7igrgi29fhmndki41a8f87cvs-criu-3.9/bin/criu passed the binary check.
- 2 of 3 passed binary check by having a zero exit code.
- 0 of 3 passed binary check by having the new version present in output.
- found 3.9 with grep in /nix/store/31grlhm7igrgi29fhmndki41a8f87cvs-criu-3.9
- directory tree listing: https://gist.github.com/5db13cedfd351a5d1fd8ed3d70ccbac3
- du listing: https://gist.github.com/3a064c8b51705c90c1093a81ab9495ee

…40995)

1) Change start-type to ```notify``` when running MariaDB so that we don't have to busy-wait for the
socket to appear.

2) Do not manually create the directory under /run as we can get systemd to do
that for us. This opens up the possibility later for not having to launch as root.

The function value cannot be serialized so nix-env was mad. Turns out we can
just remove it like we do in `lib/systems/inspect.nix`.

(cherry picked from commit a43d47121d33240e124f02cfe6b3124b28bfcf62)

nixos/slurm: fix default module parameters, update documenation

qtile: 0.10.7 -> 0.11.1

matrix-synapse: 0.28.1 -> 0.30.0

nixos/kubernetes: Update kube-dns and kube-dashbashboard docker image…

nheko: 0.4.0 -> 0.4.1

lib: Fix `nix-env -qaP -f . --xml --meta`

dockerTools: fixes extraCommands for mkRootLayer.

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/smplayer/versions.

These checks were done:

- built on NixOS
- Warning: no invocation of /nix/store/mll3p02g4sfglbg8d7z54y748z16rhwr-smplayer-18.5.0/bin/smplayer had a zero exit code or showed the expected version
- Warning: no invocation of /nix/store/mll3p02g4sfglbg8d7z54y748z16rhwr-smplayer-18.5.0/bin/simple_web_server had a zero exit code or showed the expected version
- 0 of 2 passed binary check by having a zero exit code.
- 0 of 2 passed binary check by having the new version present in output.
- found 18.5.0 with grep in /nix/store/mll3p02g4sfglbg8d7z54y748z16rhwr-smplayer-18.5.0
- directory tree listing: https://gist.github.com/68e3b40c30899a9dbba0225f52760bda
- du listing: https://gist.github.com/e7152199c8f96f4ba4fdcc614d54f3d8

Build froze and timed out during tests on i686.

build of nixos manual broke because of mismatched xml tags
in an option description introduced in #41016.

ocamlPackages.earley_ocaml: init at 1.0.2