FR: Per-group DNS resolver configuration in tailnet policy

### What are you trying to do?

We deployed AdGuard Home as a DNS resolver for our tailnet (ad/tracker blocking). The DNS is configured globally via the admin console, so it applies to every device on the tailnet.

The problem is that some users (e.g. developers, QA) run into false positives or unwanted side effects. For example, AdGuard's Safe Search feature rewrites `www.youtube.com` to `restrictmoderate.youtube.com`, which breaks YouTube comments. Other filtering rules may interfere with web development work.

We would like to assign different DNS resolver configurations to different groups of users, so that:
- Most users get the AdGuard DNS (ad blocking, security filtering)
- Developers or specific groups can use a different DNS (e.g. plain Quad9, or no override at all)

### How should we solve this?

Allow the tailnet policy file to specify DNS resolver overrides per group or tag. Something like:

```jsonc
"dns": {
// default for everyone
"nameservers": ["https://adguard.internal/dns-query"],

// per-group overrides
"overrides": [
{
"groups": ["group:developers"],
"nameservers": ["https://dns10.quad9.net/dns-query"]
},
{
"groups": ["group:no-dns-override"],
"nameservers": [] // use OS default
}
]
}
```

Alternatively, node attributes (`nodeAttrs`) could be extended to support DNS configuration per group/tag.

### What is the impact of not solving this?

Currently, DNS configuration is all-or-nothing for the entire tailnet. The only workaround is for individual users to run `tailscale set --accept-dns=false`, which also disables MagicDNS and split DNS. There is no way for admins to centrally manage per-group DNS policies.

This forces a choice between:
1. Enabling DNS filtering for everyone (and dealing with false positives for some users)
2. Disabling it entirely
3. Asking affected users to manually opt out (losing MagicDNS in the process)

### Anything else?

Related issues:
- #14397 (different DNS per tag, focused on split DNS)
- #18379 (Override DNS as more than a global switch)
- #8536 (hide DNS if not reachable by ACL)