nixos/systemd-resolved: add mDNS support option, open firewall

[Rua]

Based on #211169, this PR does three things:

• Adds a services.resolved.mdns option with sub-options to configure mDNS in systemd-resolved.
• Amends the services.resolved.llmnr so that it supports the same sub-options as mDNS.
• Adds options to open a port on the firewall for these two services.

For services.resolved.llmnr, the old enum-based value was retained but considered deprecated. I don't know if it's possible to mark use of this as explicitly deprecated, so I used types.either. This way, previous user configurations will at least continue working.

For the firewall port, I opted to make the default to open it. This follows the example of services.avahi.openFirewall, which is also enabled by default, and also makes general sense because most people will want this port open if they are going to use the service (otherwise it doesn't work). However, if a user's config specifies an old enum value instead of the new sub-options, then the firewall is not opened, which preserves the old behaviour to a degree.

To preserve backwards compatibility, I made both mDNS and LLMNR enabled by default. That is the default configuration for systemd-resolved, and in the case of mDNS that was therefore used for all previous configurations. However, I personally think that it is better for these two settings to be opt-in, so that the user is not "surprised" by services they didn't explicitly ask for. I can make them opt-in by default, but that would be a larger breaking change.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.