`ping` works, but `curl` fails, _only_ for AWS domains

### What is the issue?

Fresh install on Debian. Everything seems fine, except....`aws cli` doesn't work. So I poke around a bit, and I find:

```
> curl https://dynamodb.us-west-1.amazonaws.com
curl: (6) Could not resolve host: dynamodb.us-west-1.amazonaws.com
```

That's no good. Okay, what about my website that I'm hosting on AWS? Same same.

However, `dig` seems okay:
```
dig https://dynamodb.us-east-1.amazonaws.com

; <<>> DiG 9.10.6 <<>> https://dynamodb.us-east-1.amazonaws.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 36448
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;https://dynamodb.us-east-1.amazonaws.com. IN A

;; AUTHORITY SECTION:
us-east-1.amazonaws.com. 5 IN SOA dns-external-master.amazon.com. root.amazon.com. 17582 180 60 2592000 5

;; Query time: 19 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Jan 09 15:39:59 CET 2024
;; MSG SIZE rcvd: 137
```

Curl for other domains is fine:
```
curl https://awscli.amazonaws.com # fine
curl google.com # fine
```

I do not have MagicDNS enabled, and I have both Google and Cloudflare DNS enabled in "Nameservers" in the Tailscale UI. Approx 300 other devices on the same tailnet (and at least two on the same local network as this device) are all fine.

`/etc/resolv.conf` just contains `100.100.100.100`.

### Steps to reproduce

_No response_

### Are there any recent changes that introduced the issue?

_No response_

### OS

Linux

### OS version

Linux 5.10.168-ti-arm64-r113 bullseye

### Tailscale version

1.56.1

### Other software

`systemd-resolved`, default settings

### Bug report

BUG-8ee9f4b876d20c3aee68e946e25c80ca5bd616b5393ea77b12deffba68eeeb89-20240109144522Z-bd6ce872d5395e66