hscontrol: add libdns certificate challenges

[mine-13-zoom]

What changed

Adds provider-neutral support for tailscale cert and tailscale serve --https by advertising per-node DNSConfig.CertDomains and implementing the Noise /machine/set-dns endpoint. The endpoint validates that the authenticated node can only publish its own _acme-challenge.<node>.<base_domain> TXT record, then writes the TXT RRset through a registered libdns.RecordSetter.

The implementation does not run an authoritative DNS server and does not import any provider-specific DNS package in Headscale core. Concrete libdns providers register a factory with RegisterDNSCertificateProvider.

User impact

Operators can enable dns.certificates to let clients obtain certificates for their MagicDNS names. Clients learn support is enabled through DNSConfig.CertDomains; without that signal, tailscale cert reports HTTPS certificate support as not configured.

Safety

• Only TXT records are accepted.
• Nodes can only update their own ACME challenge name.
• Noise machine key and node key are validated before DNS updates.
• Concurrent challenge values for the same name are preserved in the RRset.
• Provider credentials in provider_config are omitted from JSON config output.

Docs

Adds config example coverage, a Serve/certificate reference page, mkdocs navigation, feature matrix updates, and changelog entry.

Tests

• go test ./hscontrol ./hscontrol/mapper ./hscontrol/types
• git diff --check