WIP: Implement wireguard tunnel in the network extension

[oskirby]

Description

In the next iteration of the split tunneling work, we merge the daemon and network-extension together. This allows some significant improvements in how the tunneling operates. Most notably:

• There is now only one privileged helper thing to install rather than two.
• The network extension error handling can be correctly plumbed into the permission required state.
• Split tunneling provider can be better coupled to interface up/down actions.
• Routing logic is much simpler:
  • The wireguard interface sets RTF_IFSCOPE on its default route.
  • Excluded apps become a no-op (let the system do its thing).
  • Included apps get bound to the VPN interface.

Much of this work came from PR #10460 and was just updated to move it into the network extension.

Quirks and TODO items

Because the split tunneling provider only catches TCP and UDP packet flows. There might be some traffic that can sneak passed the VPN when its active now (ICMP is the obvious case here). This could be a some future research... possibly engaging with the macOS firewall to block any such traffic. Theoretically Apple might also have some secret sauce that can create traffic flows that skip the NETransparentProxyProvider so we are kind of trusting Apple a lot more with this approach.

DNS. There seems to be some contention when it comes to the DNS configuration when NETransparentProxyProvider is used (see here). So as-of now, it doesn't seem like we have a good solution to setting the DNS config.

No support for native multihop. This might be doable with some future work, but it complicates the API significantly. As a first cut, I decided to disable the feature for now.

Reference

i.e Jira or Github issue URL

Checklist

• My code follows the style guidelines for this project
• I have not added any packages that contain high risk or unknown licenses (GPL, LGPL, MPL, etc. consult with DevOps if in question)
• I have performed a self review of my own code
• I have commented my code PARTICULARLY in hard to understand areas
• I have added thorough tests where needed