dockerTools: Fix streamLayeredImage for symlinks

[srhb]

When archiving /nix/store/foo and foo is itself a symlink, we must
not traverse the symlink target, but archive the foo symlink itself

I think this is sufficient to fix #107021 but I don't know a lot about the streaming mechanics here.

Motivation for this change

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[srhb]

@GrahamcOfBorg test docker-tools

[roberth]

Could you turn your example from the issue into a regression test?
Those are in nixos/tests/docker-tools.nix. You can add the image to pkgs/build-support/docker/examples.nix (or a new file for regression test images if you like).

The fix seems to make sense, but I'd appreciate a review by @utdemir.

[srhb]

@GrahamcOfBorg test docker-tools

[roberth]

@GrahamcOfBorg test docker-tools

[utdemir]

It does look good to me, given the tests pass. And I appreciate the test case.

[roberth]

Great! Thank you @srhb and @utdemir!

[purcell]

Nice, thanks for this fix! 🏆

[yurrriq]

Thank you!