FR: Acquire Internet connectivity using existing Tailscale exit node on the same network

### What are you trying to do?

I'm trying to set up a new Kubernetes cluster on AWS via Kops using private topology. On our existing cluster, the private nodes connect to the public Internet using a NAT Gateway. However, I'd very much like to destroy the NAT Gateway. I tried to set it up like this:

- Within the VPC where the EC2 instances run, there are two subnets: `utility` and `private`.
- The `utility` subnet contains a bastion node which is registered on Tailscale with an advertised exit node.
- The `private` subnet contains the actual worker and control plane nodes, which use the bastion node as their default route.

I've been able to get this far in my attempt to do this:
- Set up the bastion node via a cloud-init user script which installs Tailscale on the node using an auth key and advertises an exit node.
- Because the private nodes will not be able to install Tailscale the normal way until bootstrapping is complete, make the user script also install an Nginx server which serves the .deb file for Tailscale using the private IP of the bastion node.
- Set up a private node via a cloud-init user script which fetches the Tailscale deb from the bastion host and attempt to authenticate before `nodeup` sets up the Kubernetes node.

However, that's where I've been stumped. The problem is that because the private nodes have no connectivity, they are unable to talk to the Tailscale control server in order to start using the exit node, causing a chicken-and-egg problem. `tailscale up --exit-node` unfortunately only accepts `100.x.y.z` addresses as well. I tried a naive approach of just proxying the Tailscale control server using Nginx `proxy_pass`, however couldn't get it to work (just kept getting 400 errors and couldn't get enough debug info to proceed).

### How should we solve this?

On the `tailscale up` command, it would be nice to have a `--bootstrap-with=` option that would:
- Let the machine without public Internet register as a new machine on the control server by having the exit node proxy the control plane communication.
- Set up the exit node as the default route of the machine.

I'd expect this option to only be available when the bootstrap target is configured to advertise an exit node.

### What is the impact of not solving this?

The impact is that I have to pay for a NAT Gateway. :(

### Anything else?

_No response_