Refactor Debian/Ubuntu package

Move files for packaging outside the docs directory into its own
packaging directory. Replace the existing postinstall and postremove
scripts with Debian maintainerscripts to behave more like a typical
Debian package:

* Start and enable the headscale systemd service by default
* Does not print informational messages
* No longer stop and disable the service on updates

This package also performs migrations for all changes done in previous
package versions on upgrade:

* Set login shell to /usr/sbin/nologin
* Set home directory to /var/lib/headscale
* Migrate to system UID/GID

The package is lintian-clean with a few exceptions that are documented
as excludes and it passes puipars (both tested on Debian 12).

The following scenarious were tested on Ubuntu 22.04, Ubuntu 24.04,
Debian 11, Debian 12:

* Install
* Install same version again
* Install -> Remove -> Install
* Install -> Purge -> Install
* Purge
* Update from 0.22.0
* Update from 0.26.0

See: #2278
See: #2133
Fixes: #2311

docs/packaging/headscale.systemd.service

@@ -1,52 +0,0 @@
-[Unit]
-After=syslog.target
-After=network.target
-Description=headscale coordination server for Tailscale
-X-Restart-Triggers=/etc/headscale/config.yaml
-
-[Service]
-Type=simple
-User=headscale
-Group=headscale
-ExecStart=/usr/bin/headscale serve
-ExecReload=/usr/bin/kill -HUP $MAINPID
-Restart=always
-RestartSec=5
-
-WorkingDirectory=/var/lib/headscale
-ReadWritePaths=/var/lib/headscale /var/run
-
-AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_CHOWN
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_CHOWN
-LockPersonality=true
-NoNewPrivileges=true
-PrivateDevices=true
-PrivateMounts=true
-PrivateTmp=true
-ProcSubset=pid
-ProtectClock=true
-ProtectControlGroups=true
-ProtectHome=true
-ProtectHostname=true
-ProtectKernelLogs=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
-ProtectProc=invisible
-ProtectSystem=strict
-RemoveIPC=true
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
-RestrictNamespaces=true
-RestrictRealtime=true
-RestrictSUIDSGID=true
-RuntimeDirectory=headscale
-RuntimeDirectoryMode=0750
-StateDirectory=headscale
-StateDirectoryMode=0750
-SystemCallArchitectures=native
-SystemCallFilter=@chown
-SystemCallFilter=@system-service
-SystemCallFilter=~@privileged
-UMask=0077
-
-[Install]
-WantedBy=multi-user.target