Support tailnet lock

[michaelbeaumont]

Is your feature request related to a problem? Please describe.
It's apparently not possible to create a tailscale_tailnet_key that's been pre-signed by a signing node.

Describe the solution you'd like
A way to sign the keys created by tailscale_tailnet_key, assuming the local machine is a signing node.

Ideally the user shouldn't have to be root or the --operator user to run terraform with this resource, or should allow for privilege escalation, but obviously that requires changes to tailscale/tailscale.

[oxtoacart]

cc: @awly

[awly]

cc @knyar @icio

[knyar]

My understanding is that the provider is built to expose Tailscale REST API to Terraform. Signing an auth key does not involve that API at all - it needs a Tailscale client with a Tailnet Lock signing key. We'd need to either call LocalAPI, or run tailscale lock sign tskey-auth-XXX as a subprocess. Not sure if this provider is even the right place for that?