tailcfg,wgengine/magicsock: set peer relay CapVer (#16531)

Updates tailscale/corp#27502
Updates tailscale/corp#30051

Signed-off-by: Jordan Whited <jordan@tailscale.com>

wgengine/magicsock/magicsock_test.go

@@ -3399,7 +3399,11 @@ func Test_peerAPIIfCandidateRelayServer(t *testing.T) {
 	}
 
 	selfOnlyIPv4 := &tailcfg.Node{
-		Cap: math.MinInt32,
+		ID: 1,
+		// Intentionally set a value < 120 to verify the statically compiled
+		// [tailcfg.CurrentCapabilityVersion] is used when self is
+		// maybeCandidate.
+		Cap: 119,
 		Addresses: []netip.Prefix{
 			netip.MustParsePrefix("1.1.1.1/32"),
 		},
@@ -3409,13 +3413,17 @@ func Test_peerAPIIfCandidateRelayServer(t *testing.T) {
 	selfOnlyIPv6.Addresses[0] = netip.MustParsePrefix("::1/128")
 
 	peerOnlyIPv4 := &tailcfg.Node{
-		Cap: math.MinInt32,
+		ID:  2,
+		Cap: 120,
 		Addresses: []netip.Prefix{
 			netip.MustParsePrefix("2.2.2.2/32"),
 		},
 		Hostinfo: hostInfo.View(),
 	}
 
+	peerOnlyIPv4NotCapable := peerOnlyIPv4.Clone()
+	peerOnlyIPv4NotCapable.Cap = 119
+
 	peerOnlyIPv6 := peerOnlyIPv4.Clone()
 	peerOnlyIPv6.Addresses[0] = netip.MustParsePrefix("::2/128")
 
@@ -3500,6 +3508,22 @@ func Test_peerAPIIfCandidateRelayServer(t *testing.T) {
 			maybeCandidate: selfOnlyIPv6.View(),
 			want:           netip.AddrPortFrom(selfOnlyIPv6.Addresses[0].Addr(), 6),
 		},
+		{
+			name: "peer incapable",
+			filt: filter.New([]filtertype.Match{
+				{
+					Srcs: []netip.Prefix{netip.MustParsePrefix("2.2.2.2/32")},
+					Caps: []filtertype.CapMatch{
+						{
+							Dst: netip.MustParsePrefix("1.1.1.1/32"),
+							Cap: tailcfg.PeerCapabilityRelayTarget,
+						},
+					},
+				},
+			}, nil, nil, nil, nil, nil),
+			self:           selfOnlyIPv4.View(),
+			maybeCandidate: peerOnlyIPv4NotCapable.View(),
+		},
 		{
 			name: "no match dst",
 			filt: filter.New([]filtertype.Match{