tailscale: fix preferred MagicDNS domain matching

[NagaseMinato]

Background

A Tailscale endpoint may fail to match a MagicDNS FQDN in a route rule using preferred_by.

For example:

{
  "endpoints": [
    {
      "type": "tailscale",
      "tag": "ts-ep"
    }
  ],
  "inbounds": [
    {
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "127.0.0.1",
      "listen_port": 8080
    }
  ],
  "route": {
    "rules": [
      {
        "preferred_by": "ts-ep",
        "action": "route",
        "outbound": "ts-ep"
      }
    ]
  }
}

When accessing a MagicDNS host through the HTTP proxy:

curl --proxy http://127.0.0.1:8080 https://example.tailnet.ts.net/

the mixed inbound (also Socks, HTTP, Shadowsocks and etc.) passes the destination domain directly to route matching. No DNS resolution has occurred at this point, so the rule relies on Endpoint.PreferredDomain.

The existing implementation only checks ExportMagicDNSHosts() when MagicDNSHostsUnrouted is true. However, this flag indicates whether MagicDNS host records are covered by DNS routes, rather than whether a domain belongs to MagicDNS. It is false when MagicDNS domain routing is enabled, causing the valid host above to miss the route rule.

The Tailscale DNS transport already handles this correctly. During DNS reconfiguration, it stores the result of ExportMagicDNSHosts(). Its PreferredDomain implementation passes that registry to lookupHosts without checking MagicDNSHostsUnrouted.

DNS rules using preferred_by therefore match the MagicDNS host, while route rules do not because they use the endpoint's separate PreferredDomain implementation.