wgengine/netstack: disable refsvfs2 leak tracking (#4378)

In addition an envknob (TS_DEBUG_NETSTACK_LEAK_MODE) now provides access
to set leak tracking to more useful values.

Fixes #4309

Signed-off-by: James Tucker <james@tailscale.com>

wgengine/netstack/netstack_test.go

@@ -8,6 +8,7 @@ import (
 	"runtime"
 	"testing"
 
+	"gvisor.dev/gvisor/pkg/refs"
 	"inet.af/netaddr"
 	"tailscale.com/net/packet"
 	"tailscale.com/net/tsdial"
@@ -74,3 +75,12 @@ func getMemStats() (ms runtime.MemStats) {
 	runtime.ReadMemStats(&ms)
 	return
 }
+
+func TestNetstackLeakMode(t *testing.T) {
+	// See the comments in init(), and/or in issue #4309.
+	// Influenced by an envknob that may be useful in tests, so just check that
+	// it's not the oddly behaving zero value.
+	if refs.GetLeakMode() == 0 {
+		t.Fatalf("refs.leakMode is 0, want a non-zero value")
+	}
+}