ipn/ipnlocal: use policyclient.Client always, stop using global syspolicy funcs

Step 4 of N. See earlier commits in the series (via the issue) for the
plan.

This adds the missing methods to policyclient.Client and then uses it
everywhere in ipn/ipnlocal and locks it in with a new dep test.

Still plenty of users of the global syspolicy elsewhere in the tree,
but this is a lot of them.

Updates #16998
Updates #12614

Change-Id: I25b136539ae1eedbcba80124de842970db0ca314
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

tstest/deptest/deptest.go

@@ -24,7 +24,8 @@ import (
 type DepChecker struct {
 	GOOS     string            // optional
 	GOARCH   string            // optional
-	OnDep    func(string)      // if non-nil, called per import
+	OnDep    func(string)      // if non-nil, called per dependency
+	OnImport func(string)      // if non-nil, called per import
 	BadDeps  map[string]string // package => why
 	WantDeps set.Set[string]   // packages expected
 	Tags     string            // comma-separated
@@ -52,7 +53,8 @@ func (c DepChecker) Check(t *testing.T) {
 		t.Fatal(err)
 	}
 	var res struct {
-		Deps []string
+		Imports []string
+		Deps    []string
 	}
 	if err := json.Unmarshal(out, &res); err != nil {
 		t.Fatal(err)
@@ -66,6 +68,12 @@ func (c DepChecker) Check(t *testing.T) {
 		return strings.TrimSpace(string(out))
 	})
 
+	if c.OnImport != nil {
+		for _, imp := range res.Imports {
+			c.OnImport(imp)
+		}
+	}
+
 	for _, dep := range res.Deps {
 		if c.OnDep != nil {
 			c.OnDep(dep)