Kernel implementation of tstun

For kernel-accelerated tailscale, we need an implementation of tstun that does its work inside the kernel, aided by ebpf.

Ironically, this is the harder part of kernel-accelerating Tailscale: in addition to simply handing off the wireguard machinery to the kernel, we need packet taps on either side of wireguard, i.e. we need to observe/alter both the cleartext traffic on its way to/from the wireguard core, and the ciphertext packets flowing between wireguard and the network.

Currently, half of this is done in magicsock, and half in tstun. Ignoring the magicsock bits for a while, tstun gives us a few things that we have to replicate without our userspace process being in the path of every single packet (which would imply a tuntap interface and losing any performance gain we might have hoped for):
- Redirect traffic for 100.100.100.100 to tailscaled, so we can implement MagicDNS et al.
- Possibly some other intercepts for netstack things? Unsure.
- Inject packets into the network, going both directions (to a tailscale peer, or appearing to come from the tailscale network, for MagicDNS responses)
- Observe destination tailscale IPs with traffic (for magicsock p2p machinery activation/deactivation)

We _should_ be able to do all this in the kernel with eBPF, so that packets/events of interest can flow to us, but everything else can flow through normal kernel codepaths without any performance hit.

Tracking bug to research how to get the things we need with eBPF, and to develop a kernel-based tstun implementation.

Prerequisite for #426, since without replicating tstun functionality in kernel space, too many important tailscale features and behaviors are broken when moving wg into the kernel. As a bonus, this tstun implementation could also be used on non-kernel-wg machines as a performance optimization over the existing tstun, removing some layers of packet processing between tuntap and wireguard-go.