nixos/users-groups: dump values of password options if multiple options have definitions

[Ma27]

This was suggested since it might make it a little easier to identify the places where the definitions come from.

Retrieving the effective definitions from the module-system seems non-trivial, especially for submodules though, hence only the values are shown for now.

I'd argue that especially the password option are mostly a convenience thing for test setups. If the password is an actual secret, it should be treated as such, i.e. hashedPasswordFile should be used.

For the shadow VM test, the new section of the warning looks like this:

The values of these options are:
* users.users."leo".hashedPassword: "$6$ymzs8WINZ5wGwQcV$VC2S0cQiX8NVukOLymysTPn4v1zJoJp3NGyhnqyv/dAf4NWZsBWYveQcj6gEJr4ZUjRBRjM0Pj1L8TCQ8hUUp0"
* users.users."leo".hashedPasswordFile: null
* users.users."leo".password: null
* users.users."leo".initialHashedPassword: "!"
* users.users."leo".initialPassword: null

---

cc @K900 who brought up the suggestion
cc @infinisil because I'd be curious if there's a reasonable way to obtain definition locations for use-cases like this from options in submodules. I haven't found any.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[K900]

LGTM. Maybe we should hide passwords, but eh.

[Ma27]

Maybe we should hide passwords, but eh.

I mean, password should only be used for testing environments anyways (and if it's used, there's no point in suppressing it then in e.g. CI logs I'd argue).

Fine with being overruled on that, though.

[Ma27]

Given that we print out declarations in other places as well, I think the way this is done, is alright.
Would merge in a few days unless people bring up reservations about this change.