node selfupdate and fix subnet router when ACL is enabled (juanfont#1673

)

Fixes juanfont#1604

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>