feat: add --sudo and --sudo-ask-password flags

[zimbatm]

Copy the flags from nixos-rebuild-ng for consistency and simplicity.

--sudo now also works locally, simplifying the documentation.

[r-vdp]

Seems like some tests are still using the old argument and that causes a panic. Should we still accept the old argument and print a warning?

[zimbatm]

Fixed