Support direct Tailscale listening via tsnet

I use Tailscale for my home & away network, and want to access soft-serve over Tailscale on its own tailnet address, with soft-serve running in a container. In order to do this, I have set up a container that runs both Tailscale's containerboot and soft-serve, with tailscale funnel configurations for the HTTPS and SSH ports; this was a little cumbersome to configure and slightly brittle in practice.

The tsnet library allows Go applications to directly connect to Tailscale and expose their services as Tailscale nodes, including authenticating through an ephemeral authentication key. If soft-serve supported tsnet directly, then a single soft binary could expose its services as a Tailscale node, even from within a container, instead of or in addition to the local ports. Tailscale will also automatically handle HTTPS certificate provisioning for the tailnet address.

This is distinct from #535: that issue pertains to delegating to Tailscale SSH authentication, which could be useful for some users but is not of interest to me (I use traditional public keys instead of Tailscale SSH), while this issue is about using Tailscale's open-source library to directly expose soft-serve as a service on the user's tailnet.