Support tailnet lock

[michaelbeaumont]

Is your feature request related to a problem? Please describe.
It's apparently not possible to create a tailscale_tailnet_key that's been pre-signed by a signing node.

Describe the solution you'd like
A way to sign the keys created by tailscale_tailnet_key, assuming the local machine is a signing node.

Ideally the user shouldn't have to be root or the --operator user to run terraform with this resource, or should allow for privilege escalation, but obviously that requires changes to tailscale/tailscale.