nixos/getty: add services.getty.loginOptions

This corresponds to agetty's --login-options argument.

With this change, I can set

    services.getty.autologinUser = "qyliss";
    services.getty.loginOptions = "-- \\u";

and have my username prefilled, but with my password still
required (unlike the normal autologinUser behaviour).

nixos/modules/services/ttys/getty.nix

@@ -3,9 +3,19 @@
 with lib;
 
 let
+  cfg = config.services.getty;
 
-  autologinArg = optionalString (config.services.getty.autologinUser != null) "--autologin ${config.services.getty.autologinUser}";
-  gettyCmd = extraArgs: "@${pkgs.util-linux}/sbin/agetty agetty --login-program ${pkgs.shadow}/bin/login ${autologinArg} ${extraArgs}";
+  loginArgs = [
+    "--login-program" "${pkgs.shadow}/bin/login"
+  ] ++ optionals (cfg.autologinUser != null) [
+    "--autologin" cfg.autologinUser
+  ] ++ optionals (cfg.loginOptions != null) [
+    "--login-options" cfg.loginOptions
+  ];
+
+  gettyCmd = extraArgs:
+    "@${pkgs.util-linux}/sbin/agetty agetty ${escapeShellArgs loginArgs} "
+      + extraArgs;
 
 in
 
@@ -30,6 +40,23 @@ in
         '';
       };
 
+      loginOptions = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Template for arguments to be passed to
+          <citerefentry><refentrytitle>login</refentrytitle>
+          <manvolnum>1</manvolnum></citerefentry>.
+
+          See <citerefentry><refentrytitle>agetty</refentrytitle>
+          <manvolnum>1</manvolnum></citerefentry> for details,
+          including security considerations.  If unspecified, agetty
+          will not be invoked with a <option>--login-options</option>
+          option.
+        '';
+        example = "-h darkstar -- \u";
+      };
+
       greetingLine = mkOption {
         type = types.str;
         description = ''