get_vpn_tunnels() keyed WireGuard peers with a running counter over the
peer rows, so a peer added ahead of an existing one renumbered every peer
after it. Whatever a consumer stores per key moved with it: netOrk's site
link and tunnel check ended up on a new, offline peer and alarmed while the
real tunnel was up.
The key is now the interface and the start of the public key, as in
napalm-linux, made URL-safe because the key is a path segment. Two peers
sharing the prefix get the whole key; a row without a public key keeps its
position. IPsec and OpenVPN keys were already stable.
Every WireGuard key changes once; netOrk carries its
per-tunnel metadata across (netork#1654).
