ci: enable auto-allocate-uids for nspawn container tests

The 4 keycloak container tests require systemd-nspawn's UID-range
allocation, which Nix gates behind the auto-allocate-uids experimental
feature + setting. Without it, the runner fails with
`feature 'uid-range' requires the setting 'auto-allocate-uids' to be
enabled`. Wire both into the installer action's extra-conf so the
sandbox is set up correctly on GitHub runners.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: kmein

.github/workflows/ci.yml

@@ -11,6 +11,11 @@ jobs:
       - uses: actions/checkout@v4
 
       - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          # nspawn container tests need auto-allocate-uids + uid-range.
+          extra-conf: |
+            extra-experimental-features = auto-allocate-uids
+            auto-allocate-uids = true
 
       - uses: DeterminateSystems/magic-nix-cache-action@main