policy: allow tags to own tags

[kradalby]

As per Tailscale's implementations, Tags are allowed to
own other tags.

Closes #2866

[Copilot]

Pull request overview

This PR implements support for tags to own other tags in the policy system, allowing a hierarchical ownership structure for tag management. This aligns with Tailscale's implementation where tags can be specified as tag owners, enabling more flexible access control patterns.

Key changes:

• Added flattenTagOwners and flattenTags functions to resolve tag ownership chains and detect circular references
• Extended the Owner interface and related serialization logic to support Tag as an owner type
• Updated resolveTagOwners to handle flattened tag ownership hierarchies

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
hscontrol/policy/v2/types.go	Core implementation: added circular reference detection, tag flattening logic, and Tag support in Owner serialization
hscontrol/policy/v2/types_test.go	Comprehensive test coverage including circular reference detection, tag ownership chains, tag resolution, and alignment fixes for IPv4 fields
hscontrol/policy/v2/policy_test.go	Minor formatting fixes for User/UserID pointer consistency
hscontrol/auth_test.go	Refactored to use TypedID() method instead of direct type conversion
CHANGELOG.md	Added entry documenting the new feature

Comments suppressed due to low confidence (1)

hscontrol/policy/v2/types.go:998

• The error message says "An alias must be one of the following types" which is misleading since this is for Owner types, not Alias types. Consider changing to "An Owner must be one of the following types:"

	return nil, fmt.Errorf(`Invalid Owner %q. An alias must be one of the following types:
- user (containing an "@")
- group (starting with "group:")
- tag (starting with "tag:")

Please check the format and try again.`, s)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Comment is contradictory. It says "Should not match" but the test expects this node's IP (100.100.101.234) to be in the result (line 1776). The comment should say "Should match as we resolve the 'parent' tag."

Suggested change

	// Should not match as we resolve the "child" tag.
	// Should match as we resolve the "parent" tag.