Cut lists and hostname at decode, refuse >64 KiB of non-route Hostinfo.
The body limit counted wire bytes, not what the cache, NodeStore and
peers keep.
Fixes ANT-2026-RQS7JAPP
Fixes ANT-2026-5B6KE87K
Fixes ANT-2026-KFCFFM34
Adds DNS-01 for headscale's own certificate through dns.challenge.provider,
with the same propagation check as node certificates. Storage format
changes: first start gets a new account and certificate.
Updates #2527
Updates #504