feature/conn25: enforce policy during TransitIP allocation

Only allow TransitIPs to be allocated when the client has permission to
access the requested app.

Updates tailscale/corp#40076

Change-Id: Ib4b37afa25ffbdd220ba2c0fd9cfec8d5df5311f
Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>