Add a local control socket and nebula ctl (#1975)

Add support for accessing the previously ssh-only debug commands via
`nebula ctl <command>.`

- unix socket (named pipe on windows) for communication
- sockets scoped to the user + an optional group
- in cmd/nebula and cmd/nebula-service, but not nebula.Main

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

localapi/peercred_bsd.go

@@ -0,0 +1,25 @@
+//go:build darwin || freebsd
+
+package localapi
+
+import (
+	"net"
+
+	"golang.org/x/sys/unix"
+)
+
+// peerCheckSupported reports that this platform can identify a connecting process.
+const peerCheckSupported = true
+
+// peerUID returns the uid of the process on the other end of conn.
+func peerUID(conn net.Conn) (uid uint32, err error) {
+	err = withPeerFD(conn, func(fd int) error {
+		xu, credErr := unix.GetsockoptXucred(fd, unix.SOL_LOCAL, unix.LOCAL_PEERCRED)
+		if credErr != nil {
+			return credErr
+		}
+		uid = xu.Uid
+		return nil
+	})
+	return uid, err
+}