add ensureDBOwnership to documentation and changelog

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -529,6 +529,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `services.soju` now has a wrapper for the `sojuctl` command, pointed at the service config file. It also has the new option `adminSocket.enable`, which creates a unix admin socket at `/run/soju/admin`.
 
+- `services.postgresql.ensureUsers.*.ensureDBOwnership` now accepts a list of database names of which to set the owner besides setting it to `true` to set the owner of the database with the same name as the owner.
+
 - Gitea 1.21 upgrade has several breaking changes, including:
   - Custom themes and other assets that were previously stored in `custom/public/*` now belong in `custom/public/assets/*`
   - New instances of Gitea using MySQL now ignore the `[database].CHARSET` config option and always use the `utf8mb4` charset, existing instances should migrate via the `gitea doctor convert` CLI command.

nixos/modules/services/databases/postgresql.md

@@ -69,6 +69,9 @@ postgres by default will accept a passwordless connection via unix
 domain socket. This makes it possible to run many postgres-backed
 services without creating any database secrets at all
 
+Additionally, you can assign `services.postgresql.ensureUsers.*.ensureDBOwnership`
+to a list of database names of which to set the database ownership.
+
 ### Assigning extra permissions {#module-services-postgres-initializing-extra-permissions}
 
 For many cases, it will be enough to have the database user be the