feat: put all services into their own network and forward ports [sandboxing]

It would be really nice (at least on Linux) if we could define a toplevel network sandboxing somehow (network namespace with `netns`?)
to be able to put all services into a small bridge `br-${name}` or so. Such that ports do not collide =)

Or another mechanism to assign random ports (like devenv does) but that is probably to hard to setup and does not work.

This would just help on local setups where other stuff runs to isolate a bit.
On CI where process-compose is used for test integration that would not be a problem

```
{
self,
lib,
inputs,
...
}:
{
imports = [
inputs.process-compose-flake.flakeModule
];

perSystem =
{
config,
inputs',
modos',
...
}:
{
process-compose."test-services" =
{...}:
{
sandbox = {
implementation = "netns";
networking = {
enable = true;
portForwarding = [8080 9000];
};
};

services.authentik = {
enable = false;
};

services.keycloak = {
enable = true;
};

services.mailhog = {
enable = true;
};
};
};
}
J``

Start by reviewing the process-compose sandbox configuration shown in the issue, especially the proposed netns implementation, bridge networking, and portForwarding settings. Compare network namespaces and random-port assignment as possible approaches for local service isolation. Done should mean services can run without local port collisions while CI behavior remains unaffected.

Written by the indexing model from the issue text.