cmd/k8s-operator, net/netutil: support 4via6 in egress proxy and connector (#19863)

Add support for configuring egress to destinations reachable via 4via6
subnet routes. This change affects standalone egress proxy only- egress
ProxyGroup needs IPv6 support before being able to support 4via6. Egress may
be configured using either the synthesized 4via6 address or the MagicDNS
name (in the form
<IPv4-address-with-hyphens-instead-of-dots>-via-<siteid>[.*]).

Also update the Connector to validate and advertise 4via6 subnet routes.
Export net/netutil.ValidateViaPrefix so it can be reused by the Connector
validation logic.

Updates #19334

Signed-off-by: Becky Pauley <becky@tailscale.com>

net/netutil/routes.go

@@ -13,7 +13,11 @@ import (
 	"tailscale.com/net/tsaddr"
 )
 
-func validateViaPrefix(ipp netip.Prefix) error {
+// ValidateViaPrefix checks that the IP prefix is a valid 4via6 route.
+// It verifies that the prefix is in the Tailscale via range, has a prefix
+// length between /96 and /128, and that the embedded site ID is in the
+// range 0–65535.
+func ValidateViaPrefix(ipp netip.Prefix) error {
 	if !tsaddr.IsViaPrefix(ipp) {
 		return fmt.Errorf("%v is not a 4-in-6 prefix", ipp)
 	}
@@ -51,7 +55,7 @@ func CalcAdvertiseRoutes(advertiseRoutes string, advertiseDefaultRoute bool) ([]
 				return nil, fmt.Errorf("%s has non-address bits set; expected %s", ipp, ipp.Masked())
 			}
 			if tsaddr.IsViaPrefix(ipp) {
-				if err := validateViaPrefix(ipp); err != nil {
+				if err := ValidateViaPrefix(ipp); err != nil {
 					return nil, err
 				}
 			}