dns: add scoped nameservers.use_with_exit_node selectors

[NelsonJeppesen]

Fixes #2816

What

Add scoped dns.nameservers.use_with_exit_node selectors for global and split DNS resolvers:

dns:
  override_local_dns: true
  nameservers:
    global:
      - 100.64.0.53
    split:
      homelab.example.com:
        - 100.64.0.54
    use_with_exit_node:
      global:
        - 100.64.0.53
      split:
        homelab.example.com:
          - 100.64.0.54

Selected resolvers are sent with Tailscale dnstype.Resolver.UseWithExitNode, so supported clients keep using them after selecting an exit node.

Compatibility

• Existing stable scalar YAML for global and split is unchanged.
• The exported Nameservers.Global and Nameservers.Split Go fields retain their existing types.
• Global and split selections are independent, so one address can be enabled for a split domain without enabling its global occurrence.
• Selectors are validated against the matching configured resolver scope.
• Global selectors require dns.override_local_dns: true; split selectors do not.
• Clients older than capability version 125 ignore the wire field.

Why

By default, a Tailscale client delegates DNS to the selected exit node. That can add an unnecessary round trip for a resolver reachable through a tailnet or subnet route. This option preserves selected global or split resolvers while normal routing still determines how resolver traffic travels.

Testing

• Unit coverage verifies global and split propagation, including the same address with different scoped behavior.
• Validation coverage rejects unmatched selectors and ineffective global selectors without DNS override.
• Environment-variable coverage verifies the global selector form.
• TestExitNodeUseWithExitNodeDNS uses Tailscale 1.98, activates an exit node, performs a real tailscale dns query --json, and asserts both the effective direct resolver and returned DNS answer.
• go test ./hscontrol/types ./integration
• go vet ./...
• golangci-lint run --new-from-rev=048308511c72fa77da103e932f9b857a6e5247b9 --timeout=5m
• nix flake check --no-build
• Integration workflow generation is clean.

Local Docker execution was unavailable: go run ./cmd/hi doctor reported that no Docker daemon was running. The integration scenario is registered in CI. A repository-wide go test ./... run timed out after 10 minutes in existing TestLogoutReloginWithPollChurn; that test passed alone in 64 seconds, and all changed packages passed.

---

• have read the CONTRIBUTING.md file
• raised a GitHub issue or discussed it on the projects chat beforehand ([Feature] Support "Use with exit node" feature for nameservers #2816)
• added unit tests
• added integration tests
• updated documentation
• updated CHANGELOG.md