go.toolchain.rev: bump oss, test toolchain matches go.toolchain.rev

Update go.toolchain.rev for https://github.com/tailscale/go/pull/104 and
add a test that, when using the tailscale_go build tag, we use the
right Go toolchain.

We'll crank up the strictness in later commits.

Updates #13527

Change-Id: Ifb09a844858be2beb144a420e4e9dbdc5c03ae3a
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

go.toolchain.rev

@@ -1 +1 @@
-ed9dc37b2b000f376a3e819cbb159e2c17a2dac6
+bf15628b759344c6fc7763795a405ba65b8be5d7

version_tailscale_test.go

@@ -0,0 +1,35 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build tailscale_go
+
+package tailscaleroot
+
+import (
+	"os"
+	"runtime/debug"
+	"strings"
+	"testing"
+)
+
+func TestToolchainMatches(t *testing.T) {
+	bi, ok := debug.ReadBuildInfo()
+	if !ok {
+		t.Fatal("failed to read build info")
+	}
+	var tsRev string
+	for _, s := range bi.Settings {
+		if s.Key == "tailscale.toolchain.rev" {
+			tsRev = s.Value
+			break
+		}
+	}
+	want := strings.TrimSpace(GoToolchainRev)
+	if tsRev != want {
+		if os.Getenv("TS_PERMIT_TOOLCHAIN_MISMATCH") == "1" {
+			t.Logf("tailscale.toolchain.rev = %q, want %q; but ignoring due to TS_PERMIT_TOOLCHAIN_MISMATCH=1", tsRev, want)
+			return
+		}
+		t.Errorf("tailscale.toolchain.rev = %q, want %q; permit with TS_PERMIT_TOOLCHAIN_MISMATCH=1", tsRev, want)
+	}
+}