nixos-container: Use machinectl shell (#18825)

Using nsenter+su was suboptimal since the environment they provided was
not quite the same as the real container environment. See [1] for more
background.

Note that we directly invoke /bin/sh for `nixos-container root-login`
since setting the user's shell is quite complex. See [2] for a related
systemd issue.

[1]: https://github.com/systemd/systemd/issues/825#issuecomment-127917622
[2]: https://github.com/systemd/systemd/issues/1395