lx: re-graft AmneziaWG 2.0 obfuscation onto sagernet/wireguard-go v0.0.5

Rebase of the AWG obf graft (was e5feca7 on v0.0.3) onto v0.0.5
(2c27bbf4f9, 'Add L3 forwarding support'). 15 of 16 graft files
applied clean via 3-way; only send.go conflicted, on a single line
(upstream queuedOutboundPackets backpressure decrement vs a graft
blank line — took upstream).

Key invariant preserved: MessageEncapsulatingTransportSize=0 (graft
zeroes the sagernet encapsulating headroom; AWG obfuscation composes
the prefix itself via SendBuffers, not Bind.Send prepend). Upstream's
InputPacket/InputPackets and the new size-based outbound buffer pool
(GetOutboundBuffer/PutOutboundBuffer) are taken verbatim; the graft's
RoutineEncryption (header at buffer start) and transport-padding shift
in RoutineSequentialSender re-woven around them.

Builds clean on linux/android/windows/darwin (device/conn/tun).

device/obf_datastring.go

@@ -0,0 +1,29 @@
+package device
+
+import (
+	"encoding/base64"
+)
+
+func newDataStringObf(val string) (obf, error) {
+	return &dataStringObf{}, nil
+}
+
+type dataStringObf struct {
+}
+
+func (o *dataStringObf) Obfuscate(dst, src []byte) {
+	base64.RawStdEncoding.Encode(dst, src)
+}
+
+func (o *dataStringObf) Deobfuscate(dst, src []byte) bool {
+	base64.RawStdEncoding.Decode(dst, src)
+	return true
+}
+
+func (o *dataStringObf) ObfuscatedLen(n int) int {
+	return base64.RawStdEncoding.EncodedLen(n)
+}
+
+func (o *dataStringObf) DeobfuscatedLen(n int) int {
+	return base64.RawStdEncoding.DecodedLen(n)
+}