gokrazy/tsapp: lock down breakglass access

Point tsapp at the tailscale/breakglass fork, fetch SSH keys from EC2
IMDSv2, restrict to the sec-scan user and internal CIDRs, start on
boot, and stop after 120s idle.

Updates #1866

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

gokrazy/tsapp/config.json

@@ -11,16 +11,20 @@
     ],
     "Packages": [
         "github.com/gokrazy/serial-busybox",
-        "github.com/gokrazy/breakglass",
+        "github.com/tailscale/breakglass",
         "github.com/bradfitz/qemu-guest-kragent",
         "tailscale.com/cmd/fbstatus",
         "tailscale.com/cmd/tailscale",
         "tailscale.com/cmd/tailscaled"
     ],
     "PackageConfig": {
-        "github.com/gokrazy/breakglass": {
+        "github.com/tailscale/breakglass": {
             "CommandLineFlags": [
-                "-authorized_keys=/perm/breakglass.authorized_keys"
+                "-authorized_keys=ec2",
+                "-allowed_user=aws-marketplace-sec-scan",
+                "-allowed_cidrs=10.0.0.0/16,10.2.0.0/16",
+                "-stop_after_idle=120s",
+                "-start_on_boot=true"
             ]
         },
         "tailscale.com/cmd/tailscale": {

gokrazy/tsapp/gokrazydeps.go

@@ -7,12 +7,12 @@ package gokrazydeps
 
 import (
 	_ "github.com/bradfitz/qemu-guest-kragent"
-	_ "github.com/gokrazy/breakglass"
 	_ "github.com/gokrazy/gokrazy/cmd/dhcp"
 	_ "github.com/gokrazy/gokrazy/cmd/ntp"
 	_ "github.com/gokrazy/gokrazy/cmd/randomd"
 	_ "github.com/gokrazy/kernel.amd64"
 	_ "github.com/gokrazy/serial-busybox"
+	_ "github.com/tailscale/breakglass"
 	_ "github.com/tailscale/ts-gokrazy/gokrazyinit"
 	_ "tailscale.com/cmd/tailscale"
 	_ "tailscale.com/cmd/tailscaled"