tstest/natlab: test that a peer's name doesn't shadow a bare upstream name (#20804)

* tstest/natlab: test that a peer's name doesn't shadow a bare upstream name

With MagicDNS off, only suffixed names should be answered locally, but
since 1.102 quad-100 also answers a bare, unqualified name whenever a
tailnet device shares that name. It returns the device's Tailscale IP
instead of forwarding to the tailnet's global nameserver, leaving the
upstream record unreachable.

TestBareNameNotHijackedByPeer configures a global nameserver owning a
single-label name, adds a peer named to collide with it, and asserts the
client's lookup returns the upstream address. It queries via "tailscale
dns query" so the name stays a single label; a search domain completing
it would resolve a different name and pass regardless.

Add SplitDNSBareName to vnet's split-DNS zone to serve that name, and a
packet-level case asserting the fake server answers it.

Updates #20789

Signed-off-by: Brendan Creane <bcreane@gmail.com>

* tstest/natlab: check short names resolve via quad-100 when MagicDNS is on

TestMagicDNS asserted a peer's short name resolves, but through getent
with a search domain configured: libc completed it to the FQDN, so the
lookup never asked quad-100 for a single label. The bare-name path the
resolver takes when MagicDNS is enabled was untested.

Query the short name with "tailscale dns query" too, which asks for
exactly the name given. This is the enabled-MagicDNS mirror of
TestBareNameNotHijackedByPeer, and pins the other side of the condition
added in 1ec348784: a fix that dropped short names unconditionally,
rather than only when MagicDNS is disabled, now fails here.

Updates #20789

Signed-off-by: Brendan Creane <bcreane@gmail.com>

---------

Signed-off-by: Brendan Creane <bcreane@gmail.com>