ipn/{desktop,ipnlocal}: register per-user policy stores on session lifecycle (#20293)

This registers per-user RSOP policy stores when a user logs into a Windows session and ensures that per-user poicy settings are delivered to clients via IPN bus.

The store lifecycle is tied to Windows session lifetime via desktopSessionExt's SessionInitCallback, which handles unattended mode (per-user policies stay enforced after gui disconnection) and multi-user (refcounted across sessions for the same user).

Updates tailscale/corp#42259

Signed-off-by: kari-ts <kari@tailscale.com>