Move 'tailscale up' to its own step.

So tailscaled doesn't run with the authkey in its env. It doesn't need
to know, so don't provide it. Defense in depth.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>