Depends on #14716

When a client application connects to the new tailnet API endpoint scoped to a user (api/v2/users/me/tailnet), rather than a particular agent, we need to authenticate CoordinateRequest messages that AddTunnel such that the user can add tunnels to their own workspace agents, but not agents of other users.