syncthing: 1.30.0 -> 2.0.3; nixos/synthing: fix flags against 2.0 (#436432)

nixos/doc/manual/release-notes/rl-2505.section.md

···
   inputs.nixpkgs.url = "https://channels.nixos.org/nixos-25.05/nixexprs.tar.xz";
   ```
 
+- Syncthing has been updated to version 2.0.0.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## New Modules {#sec-release-25.05-new-modules}

nixos/modules/services/networking/syncthing.nix

···
                   install -Dm600 -o ${cfg.user} -g ${cfg.group} ${toString cfg.key} ${cfg.configDir}/key.pem
                 ''}
               ''}";
-          ExecStart = ''
-            ${cfg.package}/bin/syncthing \
-              -no-browser \
-              -gui-address=${if isUnixGui then "unix://" else ""}${cfg.guiAddress} \
-              -config=${cfg.configDir} \
-              -data=${cfg.databaseDir} \
-              ${escapeShellArgs cfg.extraFlags}
-          '';
+          ExecStart =
+            let
+              args = lib.escapeShellArgs (
+                (lib.cli.toGNUCommandLine { } {
+                  "no-browser" = true;
+                  "gui-address" = (if isUnixGui then "unix://" else "") + cfg.guiAddress;
+                  "config" = cfg.configDir;
+                  "data" = cfg.databaseDir;
+                })
+                ++ cfg.extraFlags
+              );
+            in
+            "${lib.getExe cfg.package} ${args}";
           MemoryDenyWriteExecute = true;
           NoNewPrivileges = true;
           PrivateDevices = true;

nixos/tests/syncthing-folders.nix

···
     name:
     pkgs.runCommand "syncthing-test-certs-${name}" { } ''
       mkdir -p $out
-      ${pkgs.syncthing}/bin/syncthing generate --config=$out
+      ${pkgs.syncthing}/bin/syncthing generate --home=$out
       ${pkgs.libxml2}/bin/xmllint --xpath 'string(configuration/device/@id)' $out/config.xml > $out/id
     '';
   idA = genNodeId "a";

nixos/tests/syncthing.nix

···
     a.wait_for_open_port(22000)
     b.wait_for_open_port(22000)
 
-    aDeviceID = a.succeed("syncthing -home=%s -device-id" % confdir).strip()
-    bDeviceID = b.succeed("syncthing -home=%s -device-id" % confdir).strip()
+    aDeviceID = a.succeed("syncthing --home=%s device-id" % confdir).strip()
+    bDeviceID = b.succeed("syncthing --home=%s device-id" % confdir).strip()
     addPeer(a, "b", bDeviceID)
     addPeer(b, "a", aDeviceID)
 

pkgs/applications/networking/syncthing/default.nix

···
     }:
     buildGoModule rec {
       pname = stname;
-      version = "1.30.0";
+      version = "2.0.3";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         tag = "v${version}";
-        hash = "sha256-GKyzJ2kzs2h/tfb3StSleGBofiKk6FwVcSkCjsJRvRY=";
+        hash = "sha256-s5kW7FJfLSTezG/PvRGEoBBlMhYUoszpduKFKlnCcaU=";
       };
 
-      vendorHash = "sha256-Soky/3wEmP1QRy8xfL68sTHi3CSl4nbCINmG0DY2Qys=";
+      vendorHash = "sha256-Ws++TwmOcWe1ArRuQzIgEIUCHGC30LU4Y4zYUrBkpmA=";
 
       nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
         # Recent versions of macOS seem to require binaries to be signed when