This moves gui visibility policy evaluation into an opt ipnext to avoid
recalculating and broadcasting full visibility snapshots on every peer
update. Previously, peer changes triggered a scan of the entire netmap
and sent a complete visibility map to every subscribed watcher even when
no visibility policy was configured. Instead, we evaluate
HiddenNetworkDevices using a per-session visibility filter, send full
visibility snapshots on watcher initialization, policy changes, and self
node changes, and avoid visibility processing for watchers without the
relevant poliocy.
Updates tailscale/corp#44104
Signed-off-by: kari <kari@tailscale.com>
kari
2885dabcfe