tka: move disablement logic out-of-band from AUMs

It doesn't make a ton of sense for disablement to be communicated as an AUM, because
any failure in the AUM or chain mechanism will mean disablement wont function.

Instead, tracking of the disablement secrets remains inside the state machine, but
actual disablement and communication of the disablement secret is done by the caller.

Signed-off-by: Tom DNetto <tom@tailscale.com>

tka/state.go

@@ -192,14 +192,6 @@ func (s State) applyVerifiedAUM(update AUM) (State, error) {
 		out.Keys = append(out.Keys[:idx], out.Keys[idx+1:]...)
 		return out, nil
 
-	case AUMDisableNL:
-		// TODO(tom): We should handle this at a higher level than State.
-		if !s.checkDisablement(update.DisablementSecret) {
-			return State{}, errors.New("incorrect disablement secret")
-		}
-		// Valid disablement secret, lets reset
-		return State{}, nil
-
 	default:
 		// TODO(tom): Instead of erroring, update lastHash and
 		// continue (to preserve future compatibility).