FR: Support automatic opt-out of Firefox DoH

### What are you trying to do?

Firefox enables DNS-over-HTTPS (DoH) by [default in some countries](https://support.mozilla.org/en-US/kb/firefox-dns-over-https#w_about-our-rollout-of-dns-over-https). In its default configuration, unless it detects a VPN (which doesn't seem to work with Tailscale), Firefox will use its own internal resolver, with its own internal resolver configuration for all DNS queries needed by the browser. This causes internal split-DNS domains to resolve using the Firefox-chosen DoH resolvers first in Firefox (which may return different results due to split-horizon), and for Firefox to leak internal domain information to its (not the user's) blessed resolver operators.

It should be possible for Tailscale to cause opt-out of Firefox's custom DNS behaviour.

### How should we solve this?

If possible, coordinate with the Mozilla team so that Tailscale can be detected as a VPN, and Firefox can detect when Tailscale is or is not connected.

Alternatively, create a mechanism for the [DoH Canary Domain](https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet) (`use-application-dns.net`) to resolve as NXDOMAIN for connected Tailscale clients. This could be via a generalized option in Split-DNS configuration for MagicDNS to cause a given zone to always return NXDOMAIN (which might be useful in other cases), or via a specific option. The disadvantage of this option is that Firefox seems to only check on startup, so this would not work for users who connected to Tailscale after starting Firefox.

Preferably this could be done in the control plane, since requiring client configuration is not really a significantly better solution than pushing the necessary Firefox option to disable DoH.

### What is the impact of not solving this?

DNS settings do not work properly by default for Firefox users in many scenarios.

### Anything else?

Setting a Split-DNS override for an IP that doesn't return a result (e.g. 192.0.2.1, 127.0.0.0/8 is blocked by the UI) seems like it might work, but Firefox is pretty opaque about its behaviour here and it's hard to tell for sure.