forgejo: 8.0.3 -> 9.0.0

- `nodePackages.coc-python` was dropped, as [its upstream is unmaintained](https://github.com/neoclide/coc-python). The associated `vimPlugins.coc-python` was also dropped.

  The upstream project recommends using `coc-pyright` or `coc-jedi` as replacements.

- `forgejo` has been upgraded from version 7.0 to version 9.0, see the release notes for [8.0](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#8-0-0) and [9.0](https://codeberg.org/forgejo/forgejo/milestone/7235).

- `services.forgejo.mailerPasswordFile` has been deprecated by the drop-in replacement `services.forgejo.secrets.mailer.PASSWD`,

  which is part of the new free-form `services.forgejo.secrets` option.

  `services.forgejo.secrets` is a small wrapper over systemd's `LoadCredential=`. It has the same structure (sections/keys) as

  `services.forgejo.settings` but takes file paths that will be read before service startup instead of some plaintext value.

  `services.forgejo.package` now defaults to `forgejo-lts`, the Long Term Support version of Forgejo.

- `forgejo` and `forgejo-lts` no longer support the opt-in feature [PAM (Pluggable Authentication Module)](https://forgejo.org/docs/latest/user/authentication/#pam-pluggable-authentication-module).

{ lts ? false

, version

, rev ? "refs/tags/v${version}"

, hash

, npmDepsHash

, vendorHash

    domain = "codeberg.org";

    owner = "forgejo";

    repo = "forgejo";

    rev = "v${version}";

    inherit hash;

    inherit rev hash;

  };

  frontend = buildNpmPackage {

    description = "Self-hosted lightweight software forge";

    homepage = "https://forgejo.org";

    changelog = "https://codeberg.org/forgejo/forgejo/releases/tag/${src.rev}";

    license = lib.licenses.mit;

    license = if lib.versionAtLeast version "9.0.0" then lib.licenses.gpl3Plus else lib.licenses.mit;

    maintainers = with lib.maintainers; [ emilylange urandom bendlas adamcstephens marie ];

    broken = stdenv.hostPlatform.isDarwin;

    mainProgram = "gitea";

import ./generic.nix {

  version = "8.0.3";

  hash = "sha256-PvCWUiJIs9ktuJetPYZT0V8S8+OYahCDZiZQpvWWXhY=";

  npmDepsHash = "sha256-E4eq4OompY8e+722PbSFCmcarpYBpO/n9X6GVU9AhDU=";

  vendorHash = "sha256-4l4kscwesW/cR8mZjE3G9HcVm0d1ukxbtBY6RXYRi8k=";

  version = "9.0.0";

  hash = "sha256-GzkuJ2aJ7I4/xDLLIrwcgXuInXoXzMWvQ7Z1mdGaOPw=";

  npmDepsHash = "sha256-UFUNOR+ks3hDmT7uVEToX+rMmlFL6gQqigAxl6RP37Q=";

  vendorHash = "sha256-j3BY6fEXCL82TDna80vjL25FDFLUhyMtmQW8d6GLQdk=";

  lts = false;

  nixUpdateExtraArgs = [

    "--override-filename"