DERP client verification requires matching tailscaled and derper versions

When DERP_VERIFY_CLIENTS=true, version mismatch between host tailscaled and Docker container's derper binary causes verification failures preventing legitimate Tailnet clients from using relay

Either set DERP_VERIFY_CLIENTS=false for open relay (still encrypted via TLS and WireGuard), or ensure fredliang/derper image version matches host tailscaled version. Mount tailscaled socket with -v /var/run/tailscale:/var/run/tailscale:ro only when versions match