Proxied DERP connections are made from the tailscale interface when proxy ip address is in an accepted subnet route

### What is the issue?

I'm trying to get tailscale running from within a restricted environment where all connections have to go via a proxy server. I have administrator access on the proxy server, but the machine that installing tailscale onto I want to force via the proxy server so that I can do content filtering. This machine might also roam onto different networks where there isn't content filtering so I am using tailscale as a way to connect to the proxy server (which is also available via the tailscale network). I then force all browser to connect via the proxy server.

When I run `tailscale netcheck` with tailscale offline, then the proxy sees the connection from the local network address (and tries to proxy, but it fails due to other issues). When tailscale is up, then the connection is made to the proxy using the tailscale address. This seems a bit weird to me, because shouldn't DERP connections be made using the local network and not go via tailscale? If I disable `accept-routes`, then the DERP proxy connections are made using the local network interface.

I'm not sure if this is specific to proxied connections for DERP, or it applies to all DERP connections (like when an exit node is active).

### Steps to reproduce

- Configure a restricted network where tailscale _must_ use a proxy server to access the DERP servers.
- Only allow access to the non-tailscale address of the client (specifically the client's tailscale address must not be allowed access).
- Announce a subnet route to the proxy server in tailscale
- Start tailscaled on the client (with https_proxy pointing at the required proxy server)
- `tailscale up --accept-routes` on the client

### Are there any recent changes that introduced the issue?

_No response_

### OS

Linux

### OS version

Debian testing (proxy) and Raspberry Pi (client)

### Tailscale version

1.22.2

### Bug report

_No response_