support redundant deployment

[willnorris]

currently, golink is singly-homed. That can make your coworkers sad when that one instance goes down for whatever reason. We should allow for running multiple redundant copies of golink. At a minimum, we should make it easier to run read-only replicas. Much fancier would be to allow secondary replicas to proxy writes to a single primary replica.

Related: https://github.com/tailscale/corp/issues/18849