ts_tunnel: allow IPs to map to multiple peers

The Go tailscale client follows wireguard semantics, and enforces a 1:1 mapping of IP to peer (the AllowedIPs mechanism). This has been an ongoing source of pain for us, because we want to be able to do more flexible routing (e.g. per connection load-balancing, seamless failover between subnet router pairs, ...). The Go client has grown a bunch of NAT and proxy based hacks to smuggle these use cases through that 1:1 mapping. It's made me sad for a long time, because those hacks are all different expressions of the desire to have a load-balancing/multipath building block that features can compose in different ways.

In tailscale-rs the data plane stages are decomposed enough that we could relax this 1:1 mapping fairly straightforwardly, get that LB primitive we've always wanted, and ditch a bunch of layers of confusion in the packet processing.

This is a tracking bug to look into doing that. In particular we'll need to look at what shapes of netmaps control sends us (or could send us), and figure out if it's safe to implement this relaxation without doing other things first to compensate.

Start by examining the decomposed data-plane stages and the shapes of netmaps sent by control, then compare them with the current 1:1 IP-to-peer handling. Done means establishing whether multiple peers per IP can be supported safely and identifying any prerequisite changes to packet processing; no specific files or tests are named.