Add support for application capabilities (grants)

[olistrik]

At least partially resolves #93; I didn't tackle anything about the QEncoded headers. Forwarding the capability object isn't a usecase for me so I don't have a platform to test it with.

Exposes Tailscale App Capabilities from the peer's CapMap via the {tailscale.grants} Caddy placeholder for use in CEL expression matchers, and as {http.auth.user.tailscale_grants} in user metadata.

Changes:

• auth.go: Extract grants from WhoIs response, register {tailscale.grants} replacer mapping for CEL expressions, marshal grants to JSON in user metadata
• cel_test.go: CEL integration tests. Verifies map indexing, in operator, deep field access, and empty-grants handling
• README.md: Document grants, CEL usage examples, {http.auth.user.tailscale_grants} for header forwarding
• .gitignore: Add *.test patterns to ignore go test -c binaries.
• go.sum: Clean stale entries (go mod tidy)

Usage:

tailscale_auth

# Grant value check: user has admin: true
@admin expression `{tailscale.grants}["example.com/app"][0].admin == true`
handle @admin {
       respond "Hello, admin {http.auth.user.id}"
}

# Grant existence check: only has the cap, value doesn't matter
@user expression `"example.com/app" in {tailscale.grants}`
handle @user {
       respond "Hello, user {http.auth.user.id}"
}

handle {
       respond "Access denied" 401
}