control/controlclient: only build certstore-related code with the Tailscale Go toolchain

The certstore code is impacted by golang/go#51726.
The Tailscale Go toolchain fork contains a temporary workaround,
so it can compile it. Once the upstream toolchain can compile certstore,
presumably in Go 1.18.1, we can revert this change.

Note that depaware runs with the upstream toolchain.

Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>

cmd/tailscaled/depaware.txt

@@ -88,8 +88,6 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/mdlayher/sdnotify                                 from tailscale.com/util/systemd
    L 💣 github.com/mdlayher/socket                                   from github.com/mdlayher/netlink
      💣 github.com/mitchellh/go-ps                                   from tailscale.com/safesocket
-   W    github.com/pkg/errors                                        from github.com/tailscale/certstore
-   W 💣 github.com/tailscale/certstore                               from tailscale.com/control/controlclient
         github.com/tailscale/goupnp                                  from github.com/tailscale/goupnp/dcps/internetgateway2+
         github.com/tailscale/goupnp/dcps/internetgateway2            from tailscale.com/net/portmapper
         github.com/tailscale/goupnp/httpu                            from github.com/tailscale/goupnp+

control/controlclient/sign_supported.go

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build windows && cgo
-// +build windows,cgo
+//go:build windows && cgo && tailscale_go
+// +build windows,cgo,tailscale_go
 
 // darwin,cgo is also supported by certstore but machineCertificateSubject will
 // need to be loaded by a different mechanism, so this is not currently enabled

control/controlclient/sign_supported_test.go

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build windows && cgo
-// +build windows,cgo
+//go:build windows && cgo && tailscale_go
+// +build windows,cgo,tailscale_go
 
 package controlclient
 

control/controlclient/sign_unsupported.go

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !windows || !cgo
-// +build !windows !cgo
+//go:build !windows || !cgo || !tailscale_go
+// +build !windows !cgo !tailscale_go
 
 package controlclient