zpool: don't mount created datasets directly; and fix encrypted import

This is necessary to support non-legacy mounts, since
the creation order and the required mounting order can be
different in order to not shadow any datasets.

Adding -l to the import statement is necessary to allow
encrypted datasets to be mounted later using disko-mount.

types/zpool.nix

@@ -82,7 +82,7 @@
         {
           dev = ''
             zpool list '${config.name}' >/dev/null 2>/dev/null || \
-              zpool import -R ${config.mountRoot} '${config.name}'
+              zpool import -l -R ${config.mountRoot} '${config.name}'
             ${lib.concatMapStrings (x: x.dev or "") (lib.attrValues datasetMounts)}
           '';
           fs = (datasetMounts.fs or {}) // lib.optionalAttrs (config.mountpoint != null) {