Tailscale Funnel but behind Authentication Service (OpenID/SAML or other)

### What are you trying to do?

We are trying to expose local web apps on several nodes but behind a centralized user management (a paid service which is resistant to brute force attacks etc.).
If I understand Tailscale Funnel correctly, it would allow us to expose local web apps. However, anyone could access these devices/webapps.

It seems other [services](https://ngrok.com/blog-post/authentication-with-ngrok) have that scenario covered or at least documentation for it.

Is this something you would consider for TS Funnel?

### How should we solve this?

Provide more documentation / out of the box authentication support.

### What is the impact of not solving this?

TS only works for devices we use internally. Customers without TS client can't access the software.

### Anything else?

_No response_