FR: When tunneling over DERP (TCP), drop packets to manipulate the inner TCP congestion control

### What are you trying to do?

DERP relays listen for their traffic over TCP on the HTTPS port, because everyone’s network allows outbound traffic to port 443. The DERP client actually generates packet loss with its magic sock:

https://github.com/tailscale/tailscale/blob/46505ca338797ed4a4b902afd1f989c783000475/wgengine/magicsock/derp.go#L431-L432

https://github.com/tailscale/tailscale/blob/46505ca338797ed4a4b902afd1f989c783000475/wgengine/magicsock/magicsock.go#L1387-L1398

This packet loss signals to the inner TCP congestion algorithm to slow down. But it looks like there might be some head-of-line blocking that could cause [TCP meltdown](https://web.archive.org/web/20230310043036/http:/sites.inka.de/bigred/devel/tcp-tcp.html), where the inner TCP spends all its time retransmitting. Which coincidentally, is the [Sysiphean boulder](https://apenwarr.ca/log/20100502) that @apenwarr keeps pushing up that hill.

### How should we solve this?

TBD

### What is the impact of not solving this?

The workaround is to use a totally reliable network connection between you and a DERP relay that never experiences high latency or drops packets. /s