feature/syslog, cmd/tailscaled, logpolicy: add optional --syslog flag

Add a new modular syslog feature providing a tailscaled --syslog flag
that sends the daemon's logs to the system syslog daemon instead of
stderr, which is useful when running as a daemon without a service
manager that captures stderr (e.g. OpenWrt's procd).

The feature package registers two new hooks: one to register its flag
before flag parsing, and one that tailscaled calls early in main to
redirect the standard library's default logger. Because logpolicy later
points the default logger at logtail, whose local console copy writes
to stderr, logpolicy now also consults the hook and sends its console
copy to the same sink (with timestamps disabled, as syslog records its
own).

The feature is linked by default only on Linux, FreeBSD, and OpenBSD,
and can be removed with the ts_omit_syslog build tag. If connecting to
the syslog daemon fails at startup, tailscaled logs a warning and
continues logging to stderr.

Fixes #16270

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: I8f3a92d4c1e6b70a5d29e4f61b3c874250a9de13

feature/hooks.go

@@ -4,6 +4,7 @@
 package feature
 
 import (
+	"io"
 	"net/http"
 	"net/url"
 	"os"
@@ -13,6 +14,21 @@ import (
 	"tailscale.com/types/persist"
 )
 
+// HookRegisterLogSinkFlags is a hook for the syslog feature to register
+// its flags (such as tailscaled's --syslog) with the process's default
+// flag set. If set, tailscaled calls it before flag parsing.
+var HookRegisterLogSinkFlags Hook[func()]
+
+// HookLogSink is a hook for the syslog feature to redirect the process's
+// logs to an alternate sink. If set, tailscaled calls it once early in
+// main, after flag parsing; on that first call, if the user requested an
+// alternate sink, it points the standard library's default logger at that
+// sink. It returns the sink, or nil if logs are not being redirected.
+// Later callers (such as logpolicy, which otherwise writes its console
+// copy of logs to stderr) use the returned writer to send their logs to
+// the same place.
+var HookLogSink Hook[func() io.Writer]
+
 // HookCanAutoUpdate is a hook for the clientupdate package
 // to conditionally initialize.
 var HookCanAutoUpdate Hook[func() bool]