Add a local control socket and nebula ctl (#1975)

Add support for accessing the previously ssh-only debug commands via
`nebula ctl <command>.`

- unix socket (named pipe on windows) for communication
- sockets scoped to the user + an optional group
- in cmd/nebula and cmd/nebula-service, but not nebula.Main

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

localapi/group_unix.go

@@ -0,0 +1,39 @@
+//go:build !windows
+
+package localapi
+
+import (
+	"fmt"
+	"os"
+	"os/user"
+	"strconv"
+)
+
+// lookupGroupID resolves a group's name, or a numeric gid, to the gid as a string. A
+// gid that the group database does not list is accepted as chown would accept it: the
+// operator may be naming a group the host will learn about later, or one that only a
+// directory service knows.
+func lookupGroupID(name string) (string, error) {
+	if g, err := user.LookupGroup(name); err == nil {
+		return g.Gid, nil
+	}
+
+	if _, err := strconv.ParseUint(name, 10, 32); err == nil {
+		return name, nil
+	}
+
+	return "", fmt.Errorf("group %q does not exist on this host", name)
+}
+
+// gidFor returns the gid the socket is owned by under acc: the configured group's, or
+// the daemon's own effective group when none is configured.
+func gidFor(acc Access) (int, error) {
+	if !acc.shared() {
+		return os.Getegid(), nil
+	}
+	gid, err := strconv.ParseUint(acc.Group.ID, 10, 32)
+	if err != nil {
+		return 0, fmt.Errorf("group %q resolved to %q, which is not a gid", acc.Group.Name, acc.Group.ID)
+	}
+	return int(gid), nil
+}