Merge master into staging-nixos

- The default packages in `services.jenkins.packages` have been dropped, since not every Jenkins installation needs any package at all. It's more reasonable to leave it empty and let users configure what they need.

- The `pie` hardening flag has been removed and will now error, after being deprecated in 25.11. Compilers are expected to enable PIE by default, as has been common practice since 2016 outside of Nixpkgs. If a package needs `pie` disabled pass `-no-pie` in `CFLAGS`. It is unlikely this will be necessary in many cases; due to the prevalence of default PIE toolchains, most packages incompatible with PIE already pass `-no-pie`.

## Other Notable Changes {#sec-nixpkgs-release-26.05-notable-changes}

<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

    github = "joshainglis";

    githubId = 1281131;

  };

  joshgodsiff = {

    name = "Josh Godsiff";

    email = "josh.godsiff@gmail.com";

    github = "joshgodsiff";

    githubId = 145132;

  };

  joshheinrichs-shopify = {

    name = "Josh Heinrichs";

    email = "josh.heinrichs@shopify.com";

- Cinnamon has been updated to 6.6, please check the [upstream announcement](https://www.linuxmint.com/rel_zena_whatsnew.php) for more details.

- Rspamd has been updated to 4.0. Please check the upstream [migration](https://docs.rspamd.com/tutorials/migration/#migration-to-rspamd-400) documentation, especially if you run a sharded Redis deployment.

- Budgie has been updated to 10.10, please check the [upstream announcement](https://buddiesofbudgie.org/blog/budgie-10-10-released) for more details.

- `fonts.fontconfig.useEmbeddedBitmaps` is now set to `true` by default.

        '';

        description = ''

          Extra environment variables for Open-WebUI.

          For more details see <https://docs.openwebui.com/getting-started>

          For more details see <https://docs.openwebui.com/reference/env-configuration>

        '';

      };

          RuntimeDirectoryMode = "0700";

          StateDirectory = "scrutiny";

          StateDirectoryMode = "0750";

          RemoveIPC = true;

          RestrictNamespaces = true;

          RestrictRealtime = true;

          RestrictSUIDSGID = true;

          MemoryDenyWriteExecute = true;

          SystemCallFilter = [

            "@system-service"

            "~@privileged"

            "~@resources"

          ];

          SystemCallArchitectures = "native";

          LockPersonality = true;

          CapabilityBoundingSet = "";

          NoNewPrivileges = true;

          PrivateTmp = true;

          PrivateMounts = true;

          PrivateDevices = true;

          ProtectClock = true;

          ProtectControlGroups = true;

          ProtectHome = true;

          ProtectHostname = true;

          ProtectKernelLogs = true;

          ProtectKernelModules = true;

          ProtectKernelTunables = true;

          ProtectSystem = "strict";

          ProtectProc = "invisible";

          ProcSubset = "pid";

          RestrictAddressFamilies = [

            "AF_NETLINK"

            "AF_INET"

            "AF_INET6"

            "AF_UNIX"

          ];

          SocketBindDeny = "any";

          SocketBindAllow = [

            "tcp:${toString cfg.settings.web.listen.port}"

          ];

        };

      };

    })