wireguard, linuxnodehandler: untangle WireGuard agent from the linux node handler

[bimmlerd]

Afaik, the reason the WireGuard node event handling was contained within the linuxNodeHandler code had to do with routing (and that IPSec did it this way). That dependency appears to be gone and entangling the two leads to a deadlock, as diagnosed in #24574.

This patch thus implements NodeHandler for the WireGuard agent, untangling it from the linuxNodeHandler. The wait cycle of the deadlock is thus broken, as the linuxNodeHandler doesn't otherwise acquire the IPCache lock while holding its lock.

From the perspective of the agent, the invocations of the callbacks change insofar that previously, only once the linuxNodeHandler considered itself initialised, it would forward node events. Specifically, this excluded the intial sync of nodes performed on subscribe. However, I didn't see a reason to specifically replicate this behaviour, but I'm open to feedback on that.

Fixes: #24574

Fix a possible deadlock when using WireGuard transparent encryption.

[gandro]

Thanks for the PR! I'm assuming this is blocked on the subscriber interface refactoring, but overall the approach looks sound to me.

[bimmlerd]

rebased on top of the NodeHandler interface changes in #25450, other comments addressed

[christarazi]

LGTM pending Sebastian's comments

[gandro]

Thanks!