nixos/kanidm: rename options to match upstream nomenclature

[oddlama]

This renames originUrl to redirectUri and originLanding to landingUrl,
as previously discussed here.

I tried every way I could come up with to get the module to issue a warning when users use the old option,
but unfortunately I had to give up. There seems to be no way to make it work within a submodule.
See this related issue.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[Flakebi]

I agree that the current names are not the best, I also got slightly confused while upgrading.
However, it seems like kanidm uses different names in different places. So, there’s no canonical spelling that we can adopt.
E.g. if I run kanidm system oauth2 list, I get the names we currently use:

$ kanidm system oauth2 list
class: account
class: memberof
class: oauth2_resource_server
class: oauth2_resource_server_basic
class: object
displayname: App
name: oauth-app-name
oauth2_rs_origin: …
oauth2_rs_origin_landing: …
…

Changing the name used in NixOS has a cost as it’s a breaking change.
As long as the names used in NixOS are also used in kanidm, I think we don’t need to change them (as we’d basically just switch the place in kanidm that is consistent/inconsistent with our names).

[oddlama]

True, we don't need to change them. I agree that the fact that this change would be breaking is far from optimal - still I wanted to give the option to do this if the current wording is too confusing.

I'll convert this to a draft and maybe we can revisit this at a later time if there is ever something else in kanidm that requires us to a breaking change. Then we can maybe piggyback this on top without causing an additional breakage.