Wireguard support for Mullvad and Windscribe (#565)

- `internal/wireguard` client package with unit tests
- Implementation works with kernel space or user space if unavailable
- `WIREGUARD_PRIVATE_KEY`
- `WIREGUARD_ADDRESS`
- `WIREGUARD_PRESHARED_KEY`
- `WIREGUARD_PORT`
- `internal/netlink` package used by `internal/wireguard`

internal/wireguard/route.go

@@ -0,0 +1,26 @@
+package wireguard
+
+import (
+	"fmt"
+	"net"
+
+	"github.com/vishvananda/netlink"
+)
+
+// TODO add IPv6 route if IPv6 is supported
+
+func (w *Wireguard) addRoute(link netlink.Link, dst *net.IPNet,
+	firewallMark int) (err error) {
+	route := &netlink.Route{
+		LinkIndex: link.Attrs().Index,
+		Dst:       dst,
+		Table:     firewallMark,
+	}
+
+	err = w.netlink.RouteAdd(route)
+	if err != nil {
+		return fmt.Errorf("%w: when adding route: %s", err, route)
+	}
+
+	return err
+}