feat(headless-client): use systemd-resolved DNS control by default (#6163)

Closes #5063, supersedes #5850 

Other refactors and changes made as part of this:

- Adds the ability to disable DNS control on Windows
- Removes the spooky-action-at-a-distance `from_env` functions that used
to be buried in `tunnel`
- `FIREZONE_DNS_CONTROL` is now a regular `clap` argument again

---------

Signed-off-by: Reactor Scram <ReactorScram@users.noreply.github.com>

scripts/tests/dns-failsafe.sh

@@ -1,7 +1,9 @@
 #!/usr/bin/env bash
 
 # If we set the DNS control to `systemd-resolved` but that's not available,
-# we should still boot up and allow IP / CIDR resources to work
+# the Client should bail out with an error message and non-zero exit code.
+
+set -euox pipefail
 
 source "./scripts/tests/lib.sh"
 

scripts/tests/systemd/firezone-client-headless.service

@@ -35,6 +35,7 @@ SystemCallFilter=@aio @basic-io @file-system @io-event @network-io @signal @syst
 UMask=077
 
 Environment="FIREZONE_API_URL=ws://localhost:8081"
+# TODO: Remove after #6163 gets into a release
 Environment="FIREZONE_DNS_CONTROL=systemd-resolved"
 Environment="RUST_LOG=info"