ory-hydra: init at 25.4.0

Several components of the Ory identity and access management system
already exist in nixpkgs (oathkeeper, kratos, keto). This is yet another
attempt to get it into nixpkgs as I do plan to write a nixos module that
leverages all of these components (predecessors:#393364 #145747,
both stale)

ory-hydra: impl suggestions

* remove redundant flag in presence of `-s` per
  https://github.com/NixOS/nixpkgs/pull/495436#discussion_r2869645904
  (see: http://tip.golang.org/doc/go1.22#linker)
* update `meta.description` per https://github.com/NixOS/nixpkgs/pull/495436#discussion_r2869646275

ory-hydra: add version check

* upstream has history of changing where buildinfo is stored and allow
  maintainers to update appropriately when this happens

ory-hydra: add `sqlite_omit_load_extension` tag

* consistency w/ upstream

pkgs/by-name/or/ory-hydra/package.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+buildGoModule (finalAttrs: {
+  pname = "hydra";
+  version = "25.4.0";
+
+  src = fetchFromGitHub {
+    owner = "ory";
+    repo = "hydra";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vcbJiwWoq7WA7K5WpD68za1VecNwdzqfyXuPfUpa1QU=";
+  };
+
+  vendorHash = "sha256-ADS1kBqSJXDwmCS4CCfiMvmlzzL39E0G4J2UEKXy2Qs=";
+
+  # `json1` not needed (see: https://github.com/ory/hydra/commit/93edc9ad894771c67f46ae2c57ee7e50382d73cd)
+  # `sqlite_omit_load_extension` consistency with upstream (see: https://github.com/ory/hydra/blob/master/.docker/Dockerfile-local-build#L20C58-L20C84). Will disable sqlite runtime extension loading (see: https://sqlite.org/loadext.html)
+  tags = [
+    "hsm"
+    "sqlite"
+    "sqlite_omit_load_extension"
+  ];
+
+  subPackages = [ "." ];
+
+  ldflags = [
+    "-s"
+    "-X github.com/ory/hydra/v2/driver/config.Version=v${finalAttrs.version}"
+    "-X github.com/ory/hydra/v2/driver/config.Commit=${finalAttrs.src.rev}"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = [ "version" ];
+
+  meta = {
+    description = "OpenID Certified™ OAuth 2.0 Server and OpenID Connect Provider";
+    homepage = "https://www.ory.com/hydra";
+    changelog = "https://github.com/ory/hydra/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      debtquity
+    ];
+    mainProgram = "hydra";
+  };
+})