ssh/tailssh: check if user matching autogroup:nonroot is root

Add a check to ensure that the user being matched to an
autogroup:nonroot rule is in fact a non-root user on the system.

Updates https://github.com/tailscale/corp/issues/43245

Signed-off-by: Mario Minardi <mario@tailscale.com>

tstest/natlab/vmtest/vmtest.go

@@ -1779,8 +1779,9 @@ func (e *Env) initVnet() {
 				e.server.ControlServer().SSHPolicy = &tailcfg.SSHPolicy{
 					Rules: []*tailcfg.SSHRule{{
 						Principals: []*tailcfg.SSHPrincipal{{Any: true}},
-						SSHUsers:   map[string]string{"*": "="},
-						Action:     &tailcfg.SSHAction{Accept: true},
+						// Allow permissive login + root login by default
+						SSHUsers: map[string]string{"*": "=", "root": "root"},
+						Action:   &tailcfg.SSHAction{Accept: true},
 					}},
 				}
 				break