wireguard-go: add lock order docs, checker, fix lock ordering bugs

We've had way too many deadlocks in wireguard-go over time (e.g. #18124, #18124, one I just hit on #19359, etc).

After that most recent one, I started dreaming of (and had Claude build) a static lock analyzer for wireguard-go that looks at its AST and looks at all the paths of what can be held where. It made a lock rank ordering and found some cycles, which all looked real.

Tracking bug to publish that tool and run its tests regularly as part of its CI.

(Related-ish: #12625)

/cc @raggi @tailscale/packets