policy/v2: revoke stale SSH access and recheck authentication

Updates #3517, #3508

(cherry picked from commit 4fd4da75f2)

integration/tsic/tsic.go

@@ -102,6 +102,7 @@ type TailscaleInContainer struct {
 	// optional config
 	caCerts           [][]byte
 	headscaleHostname string
+	withDERPOverHTTP  bool
 	withWebsocketDERP bool
 	withSSH           bool
 	withTags          []string
@@ -165,6 +166,15 @@ func WithWebsocketDERP(enabled bool) Option {
 	}
 }
 
+// WithDERPOverHTTP reaches the embedded DERP over plain-HTTP websockets.
+// Use with hsic.WithoutTLS so the client does not try HTTPS for DERP.
+func WithDERPOverHTTP() Option {
+	return func(tsic *TailscaleInContainer) {
+		tsic.withWebsocketDERP = true
+		tsic.withDERPOverHTTP = true
+	}
+}
+
 // WithSSH enables SSH for the Tailscale instance.
 func WithSSH() Option {
 	return func(tsic *TailscaleInContainer) {
@@ -378,6 +388,10 @@ func New(
 			tailscaleOptions.Env,
 			fmt.Sprintf("TS_DEBUG_DERP_WS_CLIENT=%t", tsic.withWebsocketDERP),
 		)
+
+		if tsic.withDERPOverHTTP {
+			tailscaleOptions.Env = append(tailscaleOptions.Env, "TS_DEBUG_USE_DERP_HTTP=true")
+		}
 	}
 
 	tailscaleOptions.ExtraHosts = append(tailscaleOptions.ExtraHosts,