This resolves unscoped policy requests to the connected user's effective
policy instead of the default scope.
Tested by changing the device-scoped AlwaysOn policy at runtime and
running tailscale syspolicy reload. Cofnirmed tailscaled immediately
enforced the updated policy with tailscale down
Updates tailscale/corp#41463
Signed-off-by: kari <kari@tailscale.com>
