policy/v2: parse, validate, and compile nodeAttrs

ACL policies now accept a top-level nodeAttrs block. Each entry hands
a list of tailcfg node capabilities to every node matching target.
Accepted target forms are the same as acls.src and grants.src: users,
groups, tags, hosts, prefixes, autogroup:member, autogroup:tagged,
and *. autogroup:self, autogroup:internet, and autogroup:danger-all
are rejected at validate time because none describes a stable
identity set a node-level attribute can attach to.

NodeAttrGrant carries Targets, Attrs, and IPPool. IPPool is parsed
but rejected at validate time -- the allocator that consumes it is
not yet implemented. nodeAttrUnsupportedCaps lists caps SaaS accepts
that headscale cannot act on (funnel today) and rejects them with a
tracking-issue link in the error.

compileNodeAttrs resolves each entry's targets, then maps every
targeted node to a tailcfg.NodeCapMap of the entry's attrs. Per-node
IPs are cached once per call so the inner attr loop is O(grants)
instead of O(grants * nodes) IP allocations.

PolicyManager grows NodeCapMap (per-node), NodeCapMaps (snapshot for
batched callers), and NodesWithChangedCapMap (drain buffer for the
self-broadcast diff). refreshNodeAttrsLocked appends to the drain
rather than overwriting so a SetUsers/SetNodes between SetPolicy and
the drain cannot lose the policy-reload diff.

hscontrol/policy/pm.go

@@ -42,6 +42,28 @@ type PolicyManager interface {
 	// both fields are empty and the caller falls back to existing behavior.
 	ViaRoutesForPeer(viewer, peer types.NodeView) types.ViaRouteResult
 
+	// NodeCapMap returns the policy-derived CapMap for the given node,
+	// or nil when no nodeAttrs entry targets it. The returned map is
+	// owned by the manager; treat it as read-only and copy before
+	// merging into a [tailcfg.Node]. It describes the node's own
+	// capabilities, not a per-viewer view.
+	NodeCapMap(id types.NodeID) tailcfg.NodeCapMap
+
+	// NodeCapMaps returns a snapshot of the per-node policy CapMap so
+	// callers can amortise lock acquisitions over a peer loop. The
+	// outer map is a fresh container; the inner [tailcfg.NodeCapMap]
+	// values are shared with the manager and read-only.
+	NodeCapMaps() map[types.NodeID]tailcfg.NodeCapMap
+
+	// NodesWithChangedCapMap returns the IDs of nodes whose nodeAttrs
+	// CapMap shifted during recent updateLocked calls. The buffer
+	// drains on read; callers consume it once per update cycle to
+	// decide which nodes need a self-targeted MapResponse.
+	// refreshNodeAttrsLocked appends to the buffer rather than
+	// overwriting, so a SetUsers/SetNodes between SetPolicy and the
+	// drain cannot lose the policy-reload diff.
+	NodesWithChangedCapMap() []types.NodeID
+
 	Version() int
 	DebugString() string
 }