feature(tailscale): take an oauth client instead of a static api token

tailscale module currently wants a static api access token via `--tailscale-token-env-var`. that token is user-owned and long-lived, which is the thing tailscale tells you not to do for service integrations — recommended path is oauth clients (tag-scoped, not tied to a person, short-lived bearers): https://tailscale.com/kb/1215/oauth-clients would be nice if cartography took the oauth client directly: ``` --tailscale-oauth-client-id-env-var TS_OAUTH_CLIENT_ID --tailscale-oauth-client-secret-env-var TS_OAUTH_CLIENT_SECRET ``` and did the `POST /api/v2/oauth/token` exchange itself before the sync. existing token flag stays untouched. right now everyone running the tailscale module ends up writing the same init-container that curls the exchange and stuffs the bearer into `TAILSCALE_TOKEN`. happy to PR.