nixos/forgejo: work around permissions error on postgresql_15

[emilylange]

Description of changes

From postgresql_15's release notes:

PostgreSQL 15 also revokes the CREATE permission from all users except
a database owner from the public (or default) schema.

https://www.postgresql.org/about/news/postgresql-15-released-2526/

This directly affects services.postgresql.ensureUsers in NixOS, leading to

permission denied for schema public

postgresql_15 is now the default for stateVersion 23.11/unstable.

So until this is resolved globally, we work around this issue.

Refs:

• https://hydra.nixos.org/build/238878803
• postgresql_15 requires granting permissions on schema public, ensureUsers insufficient #216989
• Enrich PostgreSQL ensure users and databases support #203474
• nixos/postgresql: add ensureRoles option to ensureUsers #252071
• nixos/postgresql: enrich ensure users and databases support #255961
• postgresql: default to v15 in 23.11 #254268

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.11 Release Notes (or backporting 23.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[emilylange]

@ofborg test forgejo

[bendlas]

We're defaulting to a new major version of postgres, so close before release? That's an interesting maintenance choice ...

Thanks for catching this right away!