Better detection of shared devices

This issue only applies to domain Tailnets.

If `tailscale-hostmap` is running on device A, and device B connects to A, then B will appear in A's DNS entries **even if** B cannot access A (for example, through ACLs).

The current code detects these machines as shared machines. It may be better to figure out which machines are actually reachable and only setup DNS entries for those machines.