Add a local control socket and nebula ctl (#1975)

Add support for accessing the previously ssh-only debug commands via
`nebula ctl <command>.`

- unix socket (named pipe on windows) for communication
- sockets scoped to the user + an optional group
- in cmd/nebula and cmd/nebula-service, but not nebula.Main

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

test/helpers.go

@@ -10,6 +10,18 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// ShortTempDir returns a short private directory of the test's own, removed when the
+// test ends. t.TempDir embeds the test name, which on darwin routinely pushes a unix
+// socket path laid out under it past the 104 byte sun_path limit.
+func ShortTempDir(t *testing.T) string {
+	t.Helper()
+
+	dir, err := os.MkdirTemp("", "la")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = os.RemoveAll(dir) })
+	return dir
+}
+
 // Update is the -update flag: Golden rewrites its file instead of comparing against it.
 var Update = flag.Bool("update", false, "rewrite golden files instead of comparing against them")