nixos/soju: add adminSocket.enable option

- The `krb5` module has been rewritten and moved to `security.krb5`, moving all options but `security.krb5.enable` and `security.krb5.package` into `security.krb5.settings`.

- `services.soju` now has the option `adminSocket.enable`. This option defaults to `true`, and creates a unix admin socket at `/run/soju/admin`.

- Gitea 1.21 upgrade has several breaking changes, including:

  - Custom themes and other assets that were previously stored in `custom/public/*` now belong in `custom/public/assets/*`

  - New instances of Gitea using MySQL now ignore the `[database].CHARSET` config option and always use the `utf8mb4` charset, existing instances should migrate via the `gitea doctor convert` CLI command.

let

  cfg = config.services.soju;

  stateDir = "/var/lib/soju";

  listenCfg = concatMapStringsSep "\n" (l: "listen ${l}") cfg.listen;

  runtimeDir = "/run/soju";

  listen = cfg.listen

    ++ optional cfg.adminSocket.enable "unix+admin://${runtimeDir}/admin";

  listenCfg = concatMapStringsSep "\n" (l: "listen ${l}") listen;

  tlsCfg = optionalString (cfg.tlsCertificate != null)

    "tls ${cfg.tlsCertificate} ${cfg.tlsCertificateKey}";

  logCfg = optionalString cfg.enableMessageLogging

      description = lib.mdDoc "Whether to enable message logging.";

    };

    adminSocket.enable = mkOption {

      type = types.bool;

      default = true;

      description = lib.mdDoc ''

        Listen for admin connections from sojuctl at /run/soju/admin.

      '';

    };

    httpOrigins = mkOption {

      type = types.listOf types.str;

      default = [];

        Restart = "always";

        ExecStart = "${cfg.package}/bin/soju -config ${configFile}";

        StateDirectory = "soju";

        RuntimeDirectory = "soju";

      };

    };

  };