integration: standardize test infrastructure options

Make embedded DERP server and TLS the default configuration for all
integration tests, replacing the per-test opt-in model that led to
inconsistent and flaky test behavior.

Infrastructure changes:
- DefaultConfigEnv() includes embedded DERP server settings
- New() auto-generates a proper CA + server TLS certificate pair
- CA cert is installed into container trust stores and returned by
  GetCert() so clients and internal tools (curl) trust the server
- CreateCertificate() now returns (caCert, cert, key) instead of
  discarding the CA certificate
- Add WithPublicDERP() and WithoutTLS() opt-out options
- Remove WithTLS(), WithEmbeddedDERPServerOnly(), and WithDERPAsIP()
  since all their behavior is now the default or unnecessary

Test cleanup:
- Remove all redundant WithTLS/WithEmbeddedDERPServerOnly/WithDERPAsIP
  calls from test files
- Give every test a unique WithTestName by parameterizing aclScenario,
  sshScenario, and derpServerScenario helpers
- Add WithTestName to tests that were missing it
- Document all non-standard options with inline comments explaining
  why each is needed

Updates #3139

integration/embedded_derp_test.go

@@ -28,7 +28,7 @@ func TestDERPServerScenario(t *testing.T) {
 		},
 	}
 
-	derpServerScenario(t, spec, false, func(scenario *Scenario) {
+	derpServerScenario(t, spec, "derp-tcp", false, func(scenario *Scenario) {
 		allClients, err := scenario.ListTailscaleClients()
 		requireNoErrListClients(t, err)
 		t.Logf("checking %d clients for websocket connections", len(allClients))
@@ -78,7 +78,7 @@ func TestDERPServerWebsocketScenario(t *testing.T) {
 		},
 	}
 
-	derpServerScenario(t, spec, true, func(scenario *Scenario) {
+	derpServerScenario(t, spec, "derp-ws", true, func(scenario *Scenario) {
 		allClients, err := scenario.ListTailscaleClients()
 		requireNoErrListClients(t, err)
 		t.Logf("checking %d clients for websocket connections", len(allClients))
@@ -103,6 +103,7 @@ func TestDERPServerWebsocketScenario(t *testing.T) {
 func derpServerScenario(
 	t *testing.T,
 	spec ScenarioSpec,
+	testName string,
 	websocket bool,
 	furtherAssertions ...func(*Scenario),
 ) {
@@ -117,11 +118,11 @@ func derpServerScenario(
 		[]tsic.Option{
 			tsic.WithWebsocketDERP(websocket),
 		},
-		hsic.WithTestName("derpserver"),
+		hsic.WithTestName(testName),
+		// Expose STUN port for DERP NAT traversal.
 		hsic.WithExtraPorts([]string{"3478/udp"}),
-		hsic.WithEmbeddedDERPServerOnly(),
+		// DERP clients expect the server on the standard HTTPS port.
 		hsic.WithPort(443),
-		hsic.WithTLS(),
 		hsic.WithConfigEnv(map[string]string{
 			"HEADSCALE_DERP_AUTO_UPDATE_ENABLED":   "true",
 			"HEADSCALE_DERP_UPDATE_FREQUENCY":      "10s",