ipn/ipnlocal: consolidate test-only LocalBackend methods behind ForTest

Move all the FooForTest methods on LocalBackend to instead be
methods on a new unexported forTest type which is then given out
to callers in other packages via an exported ForTest method
(panicking in non-test contexts) that returns that unexported type.

This is unusual style (exported returning unexported) but declutters
godoc and makes call sites both more explicit and easier to read
without the "ForTest" suffix polluting the symbols. Now FooForTest()
changes into ForTest().Foo().

This was motivated by a pending change moving a bunch of code out of
LocalBackend into other packages that required adding more ForTest
methods to LocalBackend to keep the tests (now in other packages)
working. Instead, do this refactor now so the future change is prettier.

Updates #12614
Updates #cleanup

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: Ib25e6d76d48dc8622ac3a955e0b1220d582e63a8

tstest/largetailnet/delta_test.go

@@ -51,7 +51,7 @@ func metricByName(t testing.TB, name string) *clientmetric.Metric {
 //   - the corresponding side effect is observable on the [LocalBackend]
 //     (a fresh peer resolvable via PeerByID, a UserProfile resolvable
 //     via UserProfile, a packet filter rule reflected in
-//     GetFilterForTest, a per-field patch reflected in PeerByID, etc.).
+//     ForTest().GetFilter, a per-field patch reflected in PeerByID, etc.).
 //
 // This is the destination-side companion to
 // [tstest/largetailnet/BenchmarkGiantTailnet], which only measures cost
@@ -201,7 +201,7 @@ func TestNetmapDeltaFastPath(t *testing.T) {
 		if !ok || uv.LoginName() != "alice@example.com" {
 			t.Errorf("UserProfile(%d) ok=%v login=%q", newUser, ok, uv.LoginName())
 		}
-		pf := lb.GetFilterForTest()
+		pf := lb.ForTest().GetFilter()
 		if got := pf.Check(netip.MustParseAddr("100.64.0.42"), selfIP4, 22, ipproto.TCP); got != filter.Accept {
 			t.Errorf("packet filter Check from new peer = %s; want Accept", got)
 		}

tstest/largetailnet/largetailnet_test.go

@@ -80,7 +80,7 @@ func BenchmarkGiantTailnetBusWatcher(b *testing.B) {
 // The wait mechanism differs by variant:
 //
 //   - busWatcher=false: block on a channel returned by
-//     [ipnlocal.LocalBackend.AwaitNodeKeyForTest] (reached via
+//     [ipnlocal.forTest.AwaitNodeKey] (reached via
 //     [tsnet.TestHooks]). The channel is closed by LocalBackend the moment
 //     the just-added peer's key appears in the netmap, so the wait has zero
 //     polling overhead.
@@ -209,7 +209,7 @@ func benchGiantTailnet(b *testing.B, busWatcher bool) {
 			// the just-added peer key has landed in the netmap.
 			// No polling, no notify fan-out cost.
 			select {
-			case <-lb.AwaitNodeKeyForTest(added.Key):
+			case <-lb.ForTest().AwaitNodeKey(added.Key):
 			case <-time.After(10 * time.Second):
 				b.Fatalf("timed out waiting for node key %v", added.Key)
 			case <-ctx.Done():