ref(netcheck): Simplify and fix hairpinning (#1051)

This removes a lot of the state everywhere to support the hairpinning,
instead using the same state we already have to handle other STUN
responses. It adds a test to verify hairpinning works.

It also fixes a bug where the IPv6 STUN probe would send packets to an
IPv4-only STUN server. This results in more DNS lookups: now if a IPv6
address is not supplied for the derp node it will be looked up in DNS.

Also note this fixes a follow up bug in the tests which used a
1.invalid hostname to avoid DNS lookups. However that still respected
the DNS "search" configuration, resulting in lookups like 1.invalid.lan
or 1.invalid.local etc. These should be anchored in the root:
1.invalid. to avoid this.