Let a group share the info API too, and serve it on windows

The info API is for other programs on the host, and on unix the only
setting between "the user nebula runs as" and "everyone" was a manual
chgrp that the next bind undid; on windows it was not served at all,
because which accounts a pipe admits had not been decided. The control
socket's `group` decides it, and the info API takes the same key.

- `local_api.info.group`: the socket is handed to the group at 0660
  unless `socket_mode` says otherwise, and a mode that gives a named
  group nothing is refused with the mode that would
- windows: served on a named pipe, the group an ACE on it as on the
  control pipe; the e2e test's helpers dial unix sockets, so it still
  skips there
- a changed group or mode on a reload is applied to the socket in place

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

examples/config.yml

@@ -255,7 +255,7 @@ punchy:
     #group: nebula
 
   # The info socket is not made available by default. If you enable it, it makes some
-  # internal state available over HTTP. It's not available on Windows.
+  # internal state available over HTTP.
   #
   # The currently supported HTTP requests are:
   #   GET /v1/identity?address=<vpn addr>[:port]  the host owning the address; the port
@@ -269,10 +269,17 @@ punchy:
   #
   #info:
     #enabled: false
-    # The absolute path to listen on.
+    # The absolute path to listen on, or a full pipe name on Windows.
     #socket: /var/run/nebula/info.sock
-    # Octal mode for the socket, as a quoted string. Defaults to "0600".
-    #socket_mode: "0600"
+    # A group (or account/group/SID on Windows) that should be allowed to access the
+    # socket. On Windows the group may read and write the pipe but not create an
+    # instance of it, so a client in the group must open the pipe asking for read and
+    # write data rather than generic read and write.
+    #group: nebula-info
+    # Octal mode for the socket, as a quoted string. Defaults to "0600" unless a
+    # group is set, in which case it defaults to "0660". On Windows a pipe has no
+    # mode and this is ignored; the group alone decides who may connect.
+    #socket_mode: "0660"
 
 # EXPERIMENTAL: relay support for networks that can't establish direct connections.
 relay: