#3923 @swamp/cve/tailworm: reachability follow-ups from #3919 review

Fixed on PR #568 with #3919, except item 6, which moved to #3924.

Medium, do first: packet filter rules whose sources are given only as capabilities (empty Srcs, non-empty SrcCaps) are dropped by inboundReachability. A host can then read as "nothing can reach it", or show a deny cell in the matrix, while peers holding that capability can connect. Keep such rules as sources like cap:, so they are listed and the host never reads as closed.

Non-blocking findings from the #3919 review (PR #568) and its own limits, for the opt-in reachability matrix:

1. Service serve forwards are mislabelled. A localapi forward configured under a Service (svc:x) is marked as a localapi port on the node itself, though it listens on the service's address, so the matrix can show (localapi) on a node rule that does not reach it.

2. coversTailnet can double count. Two equal-length prefixes covering the same block are both counted when one is written with host bits set, which could push the total past the 99 percent threshold and read as any tailnet device. Control normally sends clean prefixes.

3. The netmap extraction relies on tab-indented top-level keys in tailscale debug netmap. If that layout changes, every node reads as unknown with a message suggesting missing root. Tell an unrecognised netmap apart from no access.

4. The matrix is one column per host and becomes unreadable on large fleets (only 3 hosts were tried). Consider a per-host list above some size, or the matrix only in JSON.

5. A source outside the scanned set appears twice, as its v4 /32 and v6 /128. Pair them, or count devices rather than prefixes.

6. Moved to #3924: run once against a Tailscale-hosted tailnet.

7. The packet filter is read by a second command after the probe. If that run times out, or SSH drops between the two, the host reads as unknown with a message blaming root or operator access, even when the scan ran as root. Tell a failed read apart from no access.

8. Non-numeric IPProto entries are dropped silently, so such a rule reads as default protocols and an ICMP-only rule could show as open ports. Keep unknown entries, or mark the rule unknown.

9. Protocol names: only numeric IPProto entries are kept; map known names (icmp, tcp, udp) to numbers if tailscaled ever sends them.

10. anyTailnet is stored but the report recomputes it from the sources; keep one so they cannot drift.

11. Matrix cells use host names as given; escape a pipe in a name.