ipn/ipnlocal: only send AllowsUpdate if clientupdate feature is linked in

Like the earlier RemoteConfig change, gate Hostinfo.AllowsUpdate on
feature.IsRegistered("clientupdate") in addition to the
buildfeatures.HasClientUpdate build-tag const. tsnet binaries don't
import feature/clientupdate even though ts_omit_clientupdate isn't
set, so they shouldn't tell control they can be remotely updated.

Add the previously missing feature.Register call to
feature/clientupdate, document the binary-support requirement on
tailcfg.Hostinfo.AllowsUpdate, and make tsnet's dep test verify it
doesn't depend on feature/clientupdate.

Updates #12614

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: I526ef11f2a4141f5fce161b1f77263324014b5c4

tailcfg/tailcfg_view.go

@@ -570,7 +570,10 @@ func (v HostinfoView) WireIngress() bool { return v.ж.WireIngress }
 // if the node has any funnel endpoint enabled
 func (v HostinfoView) IngressEnabled() bool { return v.ж.IngressEnabled }
 
-// indicates that the node has opted-in to admin-console-drive remote updates
+// AllowsUpdate reports that the node has opted in to
+// admin-console-driven remote updates and that the running binary
+// includes client update support (the feature/clientupdate package,
+// which tsnet apps don't include).
 func (v HostinfoView) AllowsUpdate() bool { return v.ж.AllowsUpdate }
 
 // the current host's machine type (uname -m)