Run build in chroot

[zopsicle]

Builds should run in chroots such that pwd is always the same. This makes it harder to create non-reproducible builds. This is significant for example when using compilers that use absolute paths to source files for name mangling, such as patscc.

This requires some work:

• Set up a user namespace so we can set up a mount namespace.
• Set up a mount namespace so we can bind mount.
• Bind mount /dev, /proc, /bin/sh, /usr/bin/env, /nix/store, and possibly more.