nixos/gitlab: convert gitlab-registry-cert.service to oneshot

docker-registry.service has a `After` dependency on gitlab-registry-cert.
On the first start, docker-registry.service fails to start as it already
runs when gitlab-registry-cert.service starts up, and not when it finished.

nixos/modules/services/misc/gitlab.nix

@@ -1231,6 +1231,7 @@ in {
         ConditionPathExists = "!${cfg.registry.certFile}";
       };
       serviceConfig = {
+        Type = "oneshot";
         Slice = "system-gitlab.slice";
       };
     };