Pre-build the tsnet dep on the go module layer

This should concentrate the bulk of the build duration on the
dependency level, since it's tsnet that pulls in all those
libraries (and it changes rarely).

Dockerfile

@@ -4,7 +4,11 @@ WORKDIR /work
 ENV CGO_ENABLED=0
 
 COPY go.mod go.sum ./
-RUN go mod download && go mod verify
+RUN go mod download && \
+    go mod verify && \
+    echo 'package main\nimport (_ "tailscale.com/tsnet")\nfunc main(){}' > main.go && \
+    go build -v ./ && \
+    rm main.go
 
 COPY . .
 
@@ -13,4 +17,4 @@ RUN go build -ldflags="-s -w" -v
 FROM scratch
 COPY --from=builder /work/tsnsrv /usr/bin/tsnsrv
 
-CMD ["/usr/bin/tsnsrv"]
+CMD ["/usr/bin/tsnsrv"]