detour behavior in tailscale endpoint

detour+domain_resolver is suitable for simple proxy where there is only one per-configured remote server address.

Maybe it's better to replace detour+domain_resolver to a second tag for the original internet-facing side of endpoints like tailscale. This sencond tags serves like a "loopback" inbound, allowing singbox to route the HTTPS control_url / HTTPS DERPs traffic using existing rules.

Some uses cases include

1. send the domain of control_url/DERPs to proxy outbound for remote resolving instead of resolving it locally for better security and faster speed.

2. route tailscale control_url/DERPs to different outbounds according to select/speedtest or rules .

3. use singbox rules to have hard-coded tailnode.log.tailscale.io login.tailscale.com blocked to avoid telemetry.

4. routing UDP packets via proxies outbounds for further obfuscation(https://github.com/net4people/bbs/issues/88,
   https://github.com/ClusterM/wg-obfuscator). At the moment, this can only be used in wireguard endpoint. Port of tailscale in sing-box is not configurable and there is no easy way to distinguish traffic of multiple tailscale endpoints.

Start with the tailscale endpoint behavior described around detour+domain_resolver, the control_url and DERPs traffic, and the existing WireGuard endpoint comparison. Determine how a second tag or loopback inbound would interact with current routing and domain resolution rules; done means the proposed traffic can be distinguished, resolved, blocked, and routed through selected outbounds as described.