feat: put all services into their own network and forward ports [sandboxing]

[gabyx]

It would be really nice (at least on Linux) if we could define a toplevel network sandboxing somehow (network namespace with netns?)
to be able to put all services into a small bridge br-${name} or so. Such that ports do not collide =)

Or another mechanism to assign random ports (like devenv does) but that is probably to hard to setup and does not work.

This would just help on local setups where other stuff runs to isolate a bit.
On CI where process-compose is used for test integration that would not be a problem

{
  self,
  lib,
  inputs,
  ...
}:
{
  imports = [
    inputs.process-compose-flake.flakeModule
  ];

  perSystem =
    {
      config,
      inputs',
      modos',
      ...
    }:
    {
      process-compose."test-services" =
        {...}:
        {
          sandbox = {
             implementation = "netns";
             networking = {
                 enable = true; 
                 portForwarding = [8080 9000];
             };
          };
         
          services.authentik = {
            enable = false;
          };

          services.keycloak = {
            enable = true;
          };

          services.mailhog = {
            enable = true;
          };
        };
    };
}
J``