Merge branch 'sandbox-profiles' of git://github.com/pikajude/nix

Temporarily allow derivations to describe their full sandbox profile.
This will be eventually scaled back to a more secure setup, see the
discussion at #695