.cirrus.yml: refactor

Required by the following commit.

.cirrus.yml

@@ -1,3 +1,14 @@
+task:
+  environment:
+    CACHIX_SIGNING_KEY: ENCRYPTED[!cec502ed813cbcd0237697d2031f750186ff20eed5815b1ad950ad2f2d701702ae6ba2f0cb4cb1985687a696c8ee492c!]
+    # Save some traffic by excluding the full git history
+    CIRRUS_CLONE_DEPTH: 1
+
+  # Use the maximum timeout. Needed when rebuilding packages on a channel update.
+  timeout_in: 120m
+
+  matrix:
+    - name: modules_test
       container:
         image: nixos/nix
         # Besides virtualization, this also enables privileged containers which are required for
@@ -5,18 +16,6 @@ container:
         kvm: true
         # Needed for package builds
         memory: 8G
-
-environment:
-  CACHIX_SIGNING_KEY: ENCRYPTED[!cec502ed813cbcd0237697d2031f750186ff20eed5815b1ad950ad2f2d701702ae6ba2f0cb4cb1985687a696c8ee492c!]
-  # Save some traffic by excluding the full git history
-  CIRRUS_CLONE_DEPTH: 1
-
-task:
-  # Use the maximum timeout. Needed when rebuilding packages on a channel update.
-  timeout_in: 120m
-
-  name: modules_test
-  container:
         # A maximum of 16 CPUs is shared among all concurrent tasks.
         # https://cirrus-ci.org/faq/#are-there-any-limits
         cpu: 4
@@ -25,7 +24,6 @@ task:
           - scenario: default
           - scenario: netns
           - scenario: netnsRegtest
-
       # This script is run as root
       build_script:
         - echo "sandbox = true" >> /etc/nix/nix.conf