Services shows all services on shared device, even when blocked by ACL when using “autogroup:member”.

### What is the issue?

### Expected Behaviour:

1. Any node on my tailnet can access any other node on it.
2. All services on my tailnet are shown on https://login.tailscale.com/admin/services
3. b@example.com can only access port 8000 on a device shared with them.
4. b@example.com Services page will list their services plus port 8000 on my device X

### Actual Behaviour:

1. Any node on my tailnet can access any other node on it.
2. All services on my tailnet are shown on https://login.tailscale.com/admin/services
3. b@example.com can only access port 8000 on a device shared with them.
4. b@example.com Services page lists their services **plus ports 22,53,631 and 8000** on my device X.

### Other Observations:

**Changing the ACL to:**
```
// Access control lists.
"acls": [
{"action": "accept", "src": ["a@example.com"], "dst": ["*:*"]},
{"action": "accept", "src": ["b@example.com"], "dst": ["*:8000"]},
],
```
Generates the expected behaviour.

**Changing the ACL to:**
```
// Access control lists.
"acls": [
{"action": "accept", "src": ["autogroup:shared"], "dst": ["*:8000"]},
],
```
Correctly allows only b@example.com to access port 8000 on the shared device. But incorrectly prevents it from being listed on b@examples.com services page. I would also expect that no services be listened on my services page but some are.

**Changing the ACL to:**
```
// Access control lists.
"acls": [
{"action": "accept", "src": ["autogroup:member"], "dst": ["*:*"]},
],
```
Correctly allows only a@example.com to access anything. But incorrectly allows b@examples.com to list all services on the shared device on the services page.

### Guess about the cause:
The firewall seems to be correctly handling the ACL. However, the back end generating the services page does not correctly interpret the ACL mixed up autogroups member and shared. Resulting in some information leakage and difficulty diagnosing configuration issues.

### Steps to reproduce

**Setup:**
A device X on my tailnet a@example.com is running services on ports 22,53,631 and 8000. It is shared to b@example.com.
The ACL is:
```
// Access control lists.
"acls": [
{"action": "accept", "src": ["autogroup:member"], "dst": ["*:*"]},
{"action": "accept", "src": ["autogroup:shared"], "dst": ["*:8000"]},
],
```

### Are there any recent changes that introduced the issue?

_No response_

### OS

Linux, Windows

### OS version

Windows 10, Ubuntu 20.04

### Tailscale version

1.54.0

### Other software

_No response_

### Bug report

_No response_