tailcat: add --auto-region to find a server that moved DERP region

[gmkbenjamin]

A stop-gap, not the fix. The real fix is server-side: a saved key
should record a concrete region and bind to it at every startup, so a
published token stays true. That needs the server to change, and does
nothing for a token already published or a server already running.

This is entirely client-side, and works against what is deployed today.

Backward compatible with deployed servers

Not just "servers need no change" — this branch changes no server code
at all, so a running server cannot tell the difference.

• Every hunk in tailcat.go is inside Client. Server, locoBackend,
  onMeow and advertiseEndpoints are untouched.
• wire.go and disco.go are untouched: the token layout and the meow
  packets are byte-identical, and a corrected token is the same short
  RegionID form the server already emits.
• A probe is indistinguishable from a client connecting, because it is
  one — same meow, same node key.
• The one new packet, a disco ping that draws NotHere out of the relay,
  is handled by magicsock, not tailcat (OnDERPRecv sees only non-disco
  packets). An unknown peer's disco is dropped, so it can't get past
  --allow.

TestDiscoverRegionAllowlist still comes back empty against a prober
sending that ping, and TestClientAutoRegion completes a real tunnel
session against a server that received every new packet. Since no server
code changed, those tests are the compatibility test.

The one exception is pre-existing and explicit: a token minted before
servers carried a separate disco key can't be searched, and says so.

What it does

A server keyed with genkey --region=auto re-picks its region at every
startup, so a published token can name one it has since left; the client
then just times out. The keys in the token still identify the server, so
--auto-region keeps them, asks candidate regions whether the server is
there, connects, and prints the corrected token on stderr.

tailcat ping --auto-region --verbose tcOLD...
tailcat ssh  --auto-region tcOLD...

The search covers every region in the map, however large it grows; only
concurrency is bounded, at eight at a time. It runs outward from the
region the token names, since a server that re-picks by latency usually
lands near where it was, and asks each relay outright whether it has the
server, which is a round trip rather than a timeout. Where it found the
server is cached in $XDG_CACHE_HOME/tailcat/regions.json, so a moved
server costs one search and not one per ssh or cp.

What it does not fix

A published token is still wrong until someone stores the corrected one;
only clients carrying this change benefit; a server on a relay outside
the map stays unreachable. The region remains a mutable fact inside an
immutable address — the actual defect, still open.

One consequence worth naming: the relay now tells a token-holder which
region has the server, where an unauthorized holder previously saw the
same silence either way. Not a new capability — any DERP client with the
node key could always ask — but tailcat now asks by default under the
flag.

Testing

region_test.go covers a moved server, an unmoved one, an embedded
token, an allowlisted server, a multi-homed server, the not-found error,
the region cache, full coverage of a thirty-region map, ordering, and
the search budget. cmd/tailcat/autoregion_e2e_test.go drives the real
binary with a negative control and asserts the notice never reaches
stdout. Clean under -race.

Rebased past "harden validation of arguments passed to ssh/scp child
processes": sshProxyCommand keeps its hardened args-slice form and
quoting, with the flags a ProxyCommand carries into the child bundled in
a proxyOpts struct so --auto-region can join them.

Updates #7 — the client-search part; multi-region servers and lat/long
in tokens are untouched.

[bradfitz]

This is an area I care about fixing but I'm still thinking about how to do it best (#7) so I probably won't be merging this too quickly until I've had a moment to give it some proper though.