net/ipset, wgengine/filter/filtertype: add split-out packages

This moves NewContainsIPFunc from tsaddr to new ipset package.

And wgengine/filter types gets split into wgengine/filter/filtertype,
so netmap (and thus the CLI, etc) doesn't need to bring in ipset,
bart, etc.

Then add a test making sure the CLI deps don't regress.

Updates #1278

Change-Id: Ia246d6d9502bbefbdeacc4aef1bed9c8b24f54d5
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

wgengine/filter/tailcfg.go

@@ -9,8 +9,8 @@ import (
 	"strings"
 
 	"go4.org/netipx"
+	"tailscale.com/net/ipset"
 	"tailscale.com/net/netaddr"
-	"tailscale.com/net/tsaddr"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/ipproto"
 	"tailscale.com/types/views"
@@ -63,7 +63,7 @@ func MatchesFromFilterRules(pf []tailcfg.FilterRule) ([]Match, error) {
 			}
 			m.Srcs = append(m.Srcs, nets...)
 		}
-		m.SrcsContains = tsaddr.NewContainsIPFunc(views.SliceOf(m.Srcs))
+		m.SrcsContains = ipset.NewContainsIPFunc(views.SliceOf(m.Srcs))
 
 		for _, d := range r.DstPorts {
 			nets, err := parseIPSet(d.IP, d.Bits)