integration: add CI-scaled timeouts and curl helpers for flaky ACL tests

Add ScaledTimeout to scale EventuallyWithT timeouts by 2x on CI,
consistent with the existing PeerSyncTimeout (60s/120s) and
dockertestMaxWait (300s/600s) conventions.

Add assertCurlSuccessWithCollect and assertCurlFailWithCollect helpers
following the existing *WithCollect naming convention.
assertCurlFailWithCollect uses CurlFailFast internally for aggressive
timeouts, avoiding wasted retries when expecting blocked connections.

Apply these to the three flakiest ACL tests:

- TestACLTagPropagation: swap NetMap and curl verification order so
  the fast NetMap check (confirms MapResponse arrived) runs before
  the slower curl check. Use curl helpers and scaled timeouts.

- TestACLTagPropagationPortSpecific: use curl helpers and scaled
  timeouts.

- TestACLHostsInNetMapTable: scale the 10s EventuallyWithT timeout.

Updates #3125

integration/helpers.go

@@ -550,6 +550,23 @@ func assertLastSeenSetWithCollect(c *assert.CollectT, node *v1.Node) {
 	assert.NotNil(c, node.GetLastSeen())
 }
 
+// assertCurlSuccessWithCollect asserts that a curl request succeeds with
+// non-empty content. For use inside EventuallyWithT blocks.
+func assertCurlSuccessWithCollect(c *assert.CollectT, client TailscaleClient, url, msg string) {
+	result, err := client.Curl(url)
+	assert.NoError(c, err, msg) //nolint:testifylint // CollectT requires assert, not require
+	assert.NotEmpty(c, result, msg)
+}
+
+// assertCurlFailWithCollect asserts that a curl request fails. Uses
+// CurlFailFast internally for aggressive timeouts, avoiding wasted
+// time on retries when we expect the connection to be blocked.
+// For use inside EventuallyWithT blocks.
+func assertCurlFailWithCollect(c *assert.CollectT, client TailscaleClient, url, msg string) {
+	_, err := client.CurlFailFast(url)
+	assert.Error(c, err, msg)
+}
+
 // assertTailscaleNodesLogout verifies that all provided Tailscale clients
 // are in the logged-out state (NeedsLogin).
 func assertTailscaleNodesLogout(t assert.TestingT, clients []TailscaleClient) {