Incidentally, simplify the go generate CI workflow, by marking the dnsfallback update non-hermetic (so CI will skip it) rather than manually filter it out of `go list`. Updates #4194 Signed-off-by: David Anderson <danderson@tailscale.com>
