Add the identity command and serve it on an opt-in HTTP info API

Build slackhq/nebula#1821 ("who is this vpn address?" over a local
HTTP+JSON socket) on the command registry, so the lookup is one command
on every surface and the socket is one more local API.

identity
- `identity [-address <vpn addr>[:port]]`: no address reports this node;
  with one, this node or the peer behind an established tunnel
- Certificate fields only: name, vpn addresses, networks, unsafe
  networks, groups, fingerprint, issuer, validity, cert version; a peer's
  fingerprint is the one nebula computed when it verified the cert
- Port accepted and stripped, 4in6 unmapped, so a RemoteAddr passes
  straight through
- No tunnel is a commands.NotFound; an empty -address is refused
- Lighthouse TXT lookup shares the owner and peer lookups, keeps answering
  with the initiating certificate, and no longer panics without a default cert
- Served on ssh and nebula ctl too

Info API
- Off until `local_api.info.enabled` with `socket` and optional quoted
  octal `socket_mode` (default "0600"); nothing derived
- Serves commands declaring Command.Identity plus help; others 403 naming
  their surfaces. TestInfoAPISurface pins the set to identity
- GET /v1 is the schema; GET /v1/<cmd>?<flag>=<value> runs one; body is
  the -json rendering via commands.Render; commands.PresentationFormat
  reads json/pretty from the query the way a line is read
- 400 commands.ParamError, 403 commands.WithheldError (what Resolve now
  returns for a withheld name, so help and dispatch type-check it too),
  404 NotFound or unknown, 500 Run error, refusal with no reason, or
  recovered panic with no detail; no redirects; every miss is JSON
- listen takes a mode: bind under umask 0077 then chmod; "0660" plus a
  searchable dir opens it to a group
- The chmod, at bind and on a mode-only reload, goes through chmodSocket,
  which never follows a link: a user who can write the socket's directory
  could otherwise swap the node for a link and have a root daemon put
  0660 or 0666 on any file. Only a socket we own is chmoded. On linux the
  node is held open O_PATH|O_NOFOLLOW, checked by fstat, and chmoded
  through /proc/self/fd, so the check and the chmod land on one inode;
  fchmodat2 is the fallback without /proc. On darwin and the BSDs it is
  an Lstat check and fchmodat(AT_SYMLINK_NOFOLLOW). clearStale Lstats
  too, so a dangling link is refused rather than followed by bind on
  darwin
- One endpoint type owns bind under mutex, bind-before-release move,
  context watch and stop/unlink; each server supplies what it serves
- Reloadable through the same reconcile shape as the control socket:
  mode applied in place, unparsable section keeps what runs, control
  socket path refused by name
- Wire returns Endpoints{Control, Info} with one Stop
- Windows unsupported for now (a pipe has no mode); warned once

Tests: identity lookups and shapes; API filter, status codes, panic
recovery, socket mode, rebind, cancellation; config parsing incl. bare
0660; Wire transitions; e2e of two nebulas with the info API resolving
the peer by address and port, through shared test.HTTPDo/HTTPGet helpers.
Goldens gain identity.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

localapi/chmod_linux.go

@@ -0,0 +1,83 @@
+//go:build linux
+
+package localapi
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+
+	"golang.org/x/sys/unix"
+)
+
+// applyAccess sets the owning group and the mode of the socket node at path, and of
+// nothing else. The node is opened O_PATH, which takes a reference to the inode without
+// opening the socket itself (a socket cannot be opened, and O_PATH does not try), and
+// O_NOFOLLOW, so a symlink at path is a refusal rather than a target. What the
+// descriptor holds is checked to be a socket of ours, and the chown and the chmod are
+// then made through /proc/self/fd, which names that inode whatever is at path by then:
+// a node swapped between the look and the change, for a link or for a hard link to a
+// file of somebody's choosing, is not what gets the group or the mode. This is how
+// glibc implements fchmodat(AT_SYMLINK_NOFOLLOW) too.
+//
+// Without /proc the change falls back to fchownat and fchmodat2, which do not follow a
+// link but are by path again, so a swap in the one syscall between the check and each
+// would be changed. Older than kernel 6.6 with no /proc, the mode is not set and the
+// socket is not served.
+func applyAccess(path string, acc Access) error {
+	// The look is for the message: a link or a plain file is named as what it is, which
+	// the O_PATH open's ELOOP or the fstat below would say less well.
+	fi, err := os.Lstat(path)
+	if err != nil {
+		return err
+	}
+	if err := checkOwnSocket(path, fi); err != nil {
+		return err
+	}
+
+	fd, err := unix.Open(path, unix.O_PATH|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return &os.PathError{Op: "open", Path: path, Err: err}
+	}
+	defer unix.Close(fd)
+
+	// What the descriptor holds is what the changes land on; the Lstat above looked at
+	// the path, which may have changed since.
+	var st unix.Stat_t
+	if err := unix.Fstat(fd, &st); err != nil {
+		return &os.PathError{Op: "fstat", Path: path, Err: err}
+	}
+	if st.Mode&unix.S_IFMT != unix.S_IFSOCK || st.Uid != currentUID() {
+		return fmt.Errorf("%s was replaced while its access was being set, refusing to change it", path)
+	}
+
+	// The /proc name of the inode the descriptor holds. ENOENT from it means no /proc.
+	held := "/proc/self/fd/" + strconv.Itoa(fd)
+
+	// The group first: a chown by root clears the setgid bit, which a socket never has,
+	// but the mode is pinned afterwards either way. With no group configured the socket
+	// is handed back to the daemon's own, so taking the key out of the config on a reload
+	// takes the access away as surely as a restart would.
+	gid, err := gidFor(acc)
+	if err != nil {
+		return err
+	}
+	err = unix.Chown(held, -1, gid)
+	if err == unix.ENOENT {
+		err = unix.Fchownat(unix.AT_FDCWD, path, -1, gid, unix.AT_SYMLINK_NOFOLLOW)
+	}
+	if err != nil {
+		return &os.PathError{Op: "chown", Path: path, Err: err}
+	}
+
+	perm := uint32(acc.Mode.Perm())
+	err = unix.Chmod(held, perm)
+	if err == unix.ENOENT {
+		err = unix.Fchmodat(unix.AT_FDCWD, path, perm, unix.AT_SYMLINK_NOFOLLOW)
+	}
+	if err != nil {
+		return &os.PathError{Op: "chmod", Path: path, Err: err}
+	}
+
+	return nil
+}