Additional domain-restricted DNS servers for Tailnet name aren't used

### What is the issue?

I'm attempting to create aliases for certain nodes in my Tailnet for use with a reverse proxy -- `portainer`, `grafana`, etc. all live on the same host, which is accessible over Tailscale. I've added aliases on my internal DNS server such that `portainer.my-name.ts.net`, `grafana.my-name.ts.net`, etc. will resolve to that host's Tailscale IP, and I've added that DNS server to the Tailscale DNS config.

Directly querying the selected nameserver for the FQDN produces the expected response. However, attempting to `ping portainer.my-name.ts.net` indicates that the name could not be resolved.

It seems as if MagicDNS might do one of the following:
- Not permit queries for the Tailnet name to flow down to domain-restricted DNS servers
- Not permit domain-restricted DNS servers to serve the same domain

If either of those is the case, it seems like the MagicDNS UI should warn the user when inputting a domain-restricted server which will not be used.

(Also note that this setup is a workaround for the inability to define MagicDNS aliases for machines in the Tailnet.)

### Steps to reproduce

1) Configure a DNS server connected to the Tailnet to return a Tailscale IP for a Tailscale FQDN which does not exist in the Tailnet, e.g. `portainer.my-name.ts.net` is 100.69.42.10
2) Add this DNS server to the MagicDNS config as a restricted nameserver for the Tailnet name
a) Note that the UI does not complain about overlaps in DNS server configuration.
3) Verify from a client that:
- the name can be resolved directly from the server, e.g. `nslookup portainer.my-name.ts.net dns-server`
- the IP address returned can be reached via Tailscale, e.g. `ping 100.69.42.10`
4) Attempt to reach the newly configured name, e.g. `ping portainer.my-name.ts.net`

### Are there any recent changes that introduced the issue?

_No response_

### OS

Windows, Android

### OS version

Windows 11 23H2 (22631), Android 13

### Tailscale version

1.48.2

### Other software

OPNSense, Unbound

### Bug report

BUG-bbf583c5216cd088a6989c5fa90f7c289fe039845b07be891d299752fa1bae9e-20230920210820Z-7550cd054b3a08f9