This adds refcounted per-user policy store registration so that tailscaled can read per-user group policy settings for each logged in Windows user.
Without this, winui would only see device scope policies, since it runs in a separate process and gets policies via ipn bus.
This also updates callsites to pass actor.UserID() so that per-user stores are actually queried.
Updates tailscale/corp#42259
Signed-off-by: kari-ts <kari@tailscale.com>