Protection and termination of an outdoor underground Ethernet cable
Ethernet has isolation transformers on each end (for the inside conductors), because of this is cuts back on noise and ground loops, any common mode current is canceled out by the transformer. The isolation provided by the transformer also offers some protection.
It is wise to shield ethernet in outdoor applications, a lightning strike can generate 1000's of V/m.
As for the shield, it could be terminated on one or both ends, the shield should not extend to indoor equipment from the lightning suppressors. The suppressors shouldn't be conductive from shield to shield (and from the pic it looks like it could be via the chassis.)
I would say 4 is the best option.
Instead of running cat 5 you could also avoid all problems by running fiber. I know of multi building installations on hills that run fiber, because fiber is not conductive or susceptible to EMI (or lightning).

Other connections that are, as I understand, are even worse, is
grounding both switches (will result in ground loop), or terminating
shielded cable with shielded connector only on one side (will make EMI
and overvoltage worse).

Grounding doesn't really matter with the ethernet data or power lines (8 conductors inside) because of the isolation, and shielding doesn't matter in most cases (except I would use a shield if the cable could be affect by EMI or lightning).
The shield should not extend to a device because this could be a conduit for very large currents in the event a lightning strike induced a large current on the shield.