chore(config): resolve primary STUN servers via SRV record (fixes #10029) (#10031)

### Purpose

Fixes #10029

### Testing

```
[3JPXJ] 2025/04/03 14:36:44.601454 stun.go:146: DEBUG: Running stun for Stun@udp://[::]:22000 via fyc5mja4mz5s0vmz1txx.syncthing.net:9999
[3JPXJ] 2025/04/03 14:36:54.185157 stun.go:170: DEBUG: Stun@udp://[::]:22000 stun discovery on fyc5mja4mz5s0vmz1txx.syncthing.net:9999 resulted in no address
[3JPXJ] 2025/04/03 14:36:54.185204 stun.go:146: DEBUG: Running stun for Stun@udp://[::]:22000 via stun.internetcalls.com:3478
```

### Documentation

https://github.com/syncthing/docs/pull/904

lib/config/config.go

@@ -68,13 +68,9 @@ var (
 	DefaultTheme = "default"
 	// Default stun servers should be substituted when the configuration
 	// contains <stunServer>default</stunServer>.
-
+	// The primary stun servers are provided by us and are resolved via an SRV record
-	// DefaultPrimaryStunServers are servers provided by us (to avoid causing the public servers burden)
+	// The fallback stun servers are used if the primary ones can't be resolved or are down.
-	DefaultPrimaryStunServers = []string{
+	DefaultFallbackStunServers = []string{
-		// Discontinued because of misuse. See https://forum.syncthing.net/t/stun-server-misuse/23319
-		//"stun.syncthing.net:3478",
-	}
-	DefaultSecondaryStunServers = []string{
 		"stun.counterpath.com:3478",
 		"stun.counterpath.net:3478",
 		"stun.ekiga.net:3478",

lib/config/optionsconfiguration.go

@@ -8,8 +8,10 @@ package config
 
 import (
 	"fmt"
+	"net"
 	"runtime"
 	"slices"
+	"strings"
 
 	"github.com/syncthing/syncthing/lib/protocol"
 	"github.com/syncthing/syncthing/lib/rand"
@@ -184,15 +186,22 @@ func (opts OptionsConfiguration) StunServers() []string {
 	for _, addr := range opts.RawStunServers {
 		switch addr {
 		case "default":
-			defaultPrimaryAddresses := make([]string, len(DefaultPrimaryStunServers))
+			_, records, err := net.LookupSRV("stun", "udp", "syncthing.net")
-			copy(defaultPrimaryAddresses, DefaultPrimaryStunServers)
+			if err != nil {
-			rand.Shuffle(defaultPrimaryAddresses)
+				l.Warnln("Unable to resolve primary STUN servers via DNS:", err)
-			addresses = append(addresses, defaultPrimaryAddresses...)
+			}
 
-			defaultSecondaryAddresses := make([]string, len(DefaultSecondaryStunServers))
+			for _, record := range records {
-			copy(defaultSecondaryAddresses, DefaultSecondaryStunServers)
+				priority := record.Priority
-			rand.Shuffle(defaultSecondaryAddresses)
+				target := strings.TrimSuffix(record.Target, ".")
-			addresses = append(addresses, defaultSecondaryAddresses...)
+				address := fmt.Sprintf("%s:%d", target, record.Port)
+				l.Debugf("Resolved primary STUN server %s with priority %d", address, priority)
+				addresses = append(addresses, address)
+			}
+
+			fallbackAddresses := slices.Clone(DefaultFallbackStunServers)
+			rand.Shuffle(fallbackAddresses)
+			addresses = append(addresses, fallbackAddresses...)
 		default:
 			addresses = append(addresses, addr)
 		}