Add an option to prevents nebula tunnels from traversing unsafe_routes

[rawdigits]

This would be to ensure you don't handshake with nodes via another nebula node, unless you really want to. We already allow you to disable connecting to particular subnets, but it would be easy to read the existing unsafe_routes CIDR list and give users an option to disallow ever traversing those routes for handshakes if that is desired.