fix(net/portmapper): release mappings and UPnP connections on Close

[EhabY]

Fix flaky tests caused by UPnP state outliving portmapper.Client.Close(), and stop leaking router mappings.

1. Port upstream 91d10d38ae: query and validate the external IP before AddPortMapping, so a failed lookup cannot leave an untracked mapping on the router. Only the reordering applies; the fork lacks selectBestService and the permanent-lease retry that the rest of that commit touches.
2. Clean up on Close(): stop starting mapping attempts after Close(), release mappings that complete after it instead of storing them, and close idle UPnP HTTP connections on Close() (and again when a mapping attempt in flight during Close() finishes) so pooled connections and their goroutines do not outlive the client. Connection reuse within an attempt and the 2s idle timeout are unchanged. Not fixed upstream.
3. Bound UPnP release: limit DeletePortMapping to one second. Release runs while holding Client.mu, so an unresponsive router could block Close, SetLocalPort, and gateway changes indefinitely. Tracked upstream in tailscaled blocks ~35s on shutdown in portmapper UPnP release (context.Background, no timeout) tailscale/tailscale#21625; open fixes there (net/portmapper: add UPnP-IGD release timeout tailscale/tailscale#17615, net/portmapper: put mappings and releases into an execqueue tailscale/tailscale#18460, fix: bound UPnP mapping release with a 5s timeout tailscale/tailscale#21687) are not merged.

Validation

• Each commit passes go vet and go test -race ./net/portmapper/ on its own; builds pass for ./..., windows, darwin, linux/arm, js/wasm.
• TestUPnPMappingLifecycle (commit 2) also covers commit 1's failed-IP-lookup cases, since upstream's tests rely on test infrastructure the fork does not have. It uses a transport without an idle timeout, so connections only close if Close() closes them.
• Mutation checks: removing either CloseIdleConnections call, removing the late-mapping release, restoring the old IP-lookup order, and removing the release timeout each make the new tests fail.

Generated with Coder Agents on behalf of @EhabY.

[ethanndickson]

Curious what led to this change being warranted? My agent couldnt find a linear issue but it looks like it's fixing real issues? some of these issues also appear unfixed on upstream tailscale

For the stuff that is fixed upstream my preference would probably be that we cherry pick fixes from upstream directly

[EhabY]

I encountered this issue while running tests locally, they were flakey because connections stayed open beyond the test and triggered the "flake detection" occasionally.

Is this a real issue that somehow impacts user? Not so sure. But it seems part of this fix is already upstream and the rest have open issues 🙏