ipn/ipnlocal,net/routemanager: keep a routemanager.RouteManager updated per node

Give nodeBackend a RouteManager and keep it in sync as routing
inputs change: full netmaps resync the whole peer set (removals plus
no-op-cheap upserts), incremental netmap deltas mirror their peer
upserts and removes into the same mutation batch, and
authReconfigLocked pushes the routing-relevant prefs (exit node,
subnet route acceptance, OneCGNAT) after resolving the exit node's
stable ID to its current numeric node ID.

A selected exit node that doesn't resolve to a current peer (a
nonexistent node, or MDM's "auto:any" placeholder awaiting
resolution) is not the same as no exit node: per the long-standing
ipn.Prefs.ExitNodeID contract, it blackholes internet traffic rather
than letting it escape to the local network. RouteManager's Prefs
gains an ExitNodeSelected bit so its OS route set keeps the default
routes in that case, with no outbound peer to carry them, matching
what routerConfigLocked does today, as pinned by TestRouterConfigExitNodeBlackhole in the previous commit.

All mutations happen with nodeBackend.mu held, satisfying the
RouteManager's serialized Begin/Commit contract.

Nothing consumes its snapshots yet; the wgengine data plane and OS
router wiring come next.

Updates #12542

Change-Id: I677b6b2c9efb8e41b3d27071bd9db73e01640d3b
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

cmd/k8s-operator/depaware.txt

@@ -811,6 +811,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/net/proxymux                                   from tailscale.com/tsnet
         tailscale.com/net/routecheck                                 from tailscale.com/client/local+
         tailscale.com/net/routecheck/peernode                        from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/routemanager                               from tailscale.com/ipn/ipnlocal
      💣 tailscale.com/net/sockopts                                   from tailscale.com/wgengine/magicsock
         tailscale.com/net/socks5                                     from tailscale.com/tsnet
         tailscale.com/net/sockstats                                  from tailscale.com/control/controlclient+

cmd/tailscaled/depaware-min.txt

@@ -109,6 +109,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/net/ping                                       from tailscale.com/net/netcheck+
         tailscale.com/net/portmapper/portmappertype                  from tailscale.com/net/netcheck+
         tailscale.com/net/routecheck/peernode                        from tailscale.com/ipn/ipnlocal
+        tailscale.com/net/routemanager                               from tailscale.com/ipn/ipnlocal
         tailscale.com/net/sockopts                                   from tailscale.com/wgengine/magicsock
         tailscale.com/net/sockstats                                  from tailscale.com/control/controlclient+
         tailscale.com/net/stun                                       from tailscale.com/net/netcheck+

cmd/tailscaled/depaware-minbox.txt

@@ -126,6 +126,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/net/ping                                       from tailscale.com/net/netcheck+
         tailscale.com/net/portmapper/portmappertype                  from tailscale.com/net/netcheck+
         tailscale.com/net/routecheck/peernode                        from tailscale.com/ipn/ipnlocal
+        tailscale.com/net/routemanager                               from tailscale.com/ipn/ipnlocal
         tailscale.com/net/sockopts                                   from tailscale.com/wgengine/magicsock
         tailscale.com/net/sockstats                                  from tailscale.com/control/controlclient+
         tailscale.com/net/stun                                       from tailscale.com/net/netcheck+

cmd/tailscaled/depaware.txt

@@ -384,6 +384,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/net/proxymux                                   from tailscale.com/cmd/tailscaled
         tailscale.com/net/routecheck                                 from tailscale.com/feature/routecheck+
         tailscale.com/net/routecheck/peernode                        from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/routemanager                               from tailscale.com/ipn/ipnlocal
         tailscale.com/net/routetable                                 from tailscale.com/doctor/routetable
      💣 tailscale.com/net/sockopts                                   from tailscale.com/wgengine/magicsock+
         tailscale.com/net/socks5                                     from tailscale.com/cmd/tailscaled

cmd/tsidp/depaware.txt

@@ -210,6 +210,7 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/net/proxymux                                   from tailscale.com/tsnet
         tailscale.com/net/routecheck                                 from tailscale.com/client/local+
         tailscale.com/net/routecheck/peernode                        from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/routemanager                               from tailscale.com/ipn/ipnlocal
      💣 tailscale.com/net/sockopts                                   from tailscale.com/wgengine/magicsock
         tailscale.com/net/socks5                                     from tailscale.com/tsnet
         tailscale.com/net/sockstats                                  from tailscale.com/control/controlclient+