Add a local control socket and nebula ctl (#1975)

Add support for accessing the previously ssh-only debug commands via
`nebula ctl <command>.`

- unix socket (named pipe on windows) for communication
- sockets scoped to the user + an optional group
- in cmd/nebula and cmd/nebula-service, but not nebula.Main

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

localapi/group_windows.go

@@ -0,0 +1,30 @@
+//go:build windows
+
+package localapi
+
+import (
+	"fmt"
+	"strings"
+
+	"golang.org/x/sys/windows"
+)
+
+// lookupGroupID resolves an account name, local or domain qualified, or a SID written
+// out, to the SID as a string, which is how the pipe's security descriptor names it.
+// Any account the host can resolve is accepted, as docker accepts any SID for its -G: a
+// group is the natural thing to name, but the descriptor does not care.
+func lookupGroupID(name string) (string, error) {
+	if strings.HasPrefix(strings.ToUpper(name), "S-1-") {
+		sid, err := windows.StringToSid(name)
+		if err != nil {
+			return "", fmt.Errorf("%q is not a SID: %w", name, err)
+		}
+		return sid.String(), nil
+	}
+
+	sid, _, _, err := windows.LookupSID("", name)
+	if err != nil {
+		return "", fmt.Errorf("account %q does not exist on this host: %w", name, err)
+	}
+	return sid.String(), nil
+}