integration: add tailscale cert test

Every client version gets a certificate from Pebble through rfc2136 and
a TSIG-checked DNS server in the test process, then runs each serve
mode; identity headers name the requesting user.

Updates #2137
Updates #1921

go.mod

@@ -24,6 +24,7 @@ require (
 	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/jagottsicher/termcolor v1.0.2
 	github.com/kradalby/libdns-gigahost v0.0.0-20261014145029-4c03bc63b974
+	github.com/letsencrypt/pebble/v2 v2.10.1
 	github.com/libdns/acmedns v0.5.0
 	github.com/libdns/cloudflare v0.2.2
 	github.com/libdns/hetzner/v2 v2.0.1
@@ -173,6 +174,7 @@ require (
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/klauspost/compress v1.20.1 // indirect
 	github.com/kradalby/gigahost-go/client v0.0.0-20261014144355-025b38b667ed // indirect
+	github.com/letsencrypt/challtestsrv v1.4.2 // indirect
 	github.com/lib/pq v1.12.3 // indirect
 	github.com/lithammer/fuzzysearch v1.1.8 // indirect
 	github.com/mattn/go-colorable v0.1.15 // indirect