policy/v2: add via exit node captures with unrelated rules

SaaS keeps via exit steering unless a rule reaches the internet, and
sends exit nodes every rule, with or without via.

Updates #3493

hscontrol/policy/v2/tailscale_grants_compat_test.go

@@ -156,8 +156,18 @@ var grantSkipReasons = map[string]string{
 	// SaaS lists contiguous source addresses one by one and writes
 	// autogroup:internet as address ranges; headscale merges sources into
 	// ranges and writes the internet as prefixes. The address sets match;
-	// TestViaGrantMapCompat compares this capture's filters by address.
+	// TestViaGrantMapCompat compares these captures' filters by address.
 	"via-grant-v52": "FILTER_ADDRESS_FORM: same addresses, different wire form",
+	"via-grant-v53": "FILTER_ADDRESS_FORM: same addresses, different wire form",
+	"via-grant-v54": "FILTER_ADDRESS_FORM: same addresses, different wire form",
+	"via-grant-v55": "FILTER_ADDRESS_FORM: same addresses, different wire form",
+	"via-grant-v56": "FILTER_ADDRESS_FORM: same addresses, different wire form",
+	"via-grant-v57": "FILTER_ADDRESS_FORM: same addresses, different wire form",
+	"via-grant-v58": "FILTER_ADDRESS_FORM: same addresses, different wire form",
+	"via-grant-v59": "FILTER_ADDRESS_FORM: same addresses, different wire form",
+	"via-grant-v60": "FILTER_ADDRESS_FORM: same addresses, different wire form and rule order",
+	"via-grant-v61": "FILTER_ADDRESS_FORM: same addresses, different wire form",
+	"via-grant-v62": "FILTER_ADDRESS_FORM: same addresses, different wire form",
 }
 
 // TestGrantsCompat is a data-driven test that loads all GRANT-*.json

hscontrol/servertest/via_compat_test.go

@@ -40,6 +40,16 @@ var viaCompatTests = []struct {
 	{"via-grant-v35", "via grant with unadvertised destination"},
 	{"via-grant-v36", "full complex: peer connectivity + crossed subnet + crossed exit"},
 	{"via-grant-v52", "members reach the internet only via tag:exit, admins reach everything"},
+	{"via-grant-v53", "via exit steering plus a member rule to a tagged host port"},
+	{"via-grant-v54", "via exit steering plus a member rule to autogroup:self"},
+	{"via-grant-v55", "via exit steering plus a member rule to a private subnet"},
+	{"via-grant-v56", "via exit steering plus a plain member rule to autogroup:internet"},
+	{"via-grant-v57", "via exit steering plus a member rule to a non-via exit node"},
+	{"via-grant-v58", "no via grant: approved exit nodes plus a member rule to a tagged host port"},
+	{"via-grant-v59", "via exit steering for tagged clients; members have an unrelated rule"},
+	{"via-grant-v60", "user-owned exit node outside the via tag; members have an autogroup:self rule"},
+	{"via-grant-v61", "via exit steering plus a member capability grant to a tagged host"},
+	{"via-grant-v62", "via exit steering plus a member rule to autogroup:internet on one port"},
 }
 
 // TestViaGrantMapCompat loads golden captures from Tailscale SaaS and