Fix DERP browser URLs to include non-standard ports.

Tailscale's browser DERP paths ignore DERPPort when building WebSocket
and HTTP-only netcheck probe URLs, causing connections to fail when DERP
servers run on non-443 ports (e.g. :8443). The TCP dial path correctly
handles DERPPort but the browser paths used by WASM builds do not.

--- a/derp/derphttp/derphttp_client.go
+++ b/derp/derphttp/derphttp_client.go
@@ -279,10 +279,19 @@
 		return c.url.String()
 	}
 	proto := "https"
+	var port string
 	if debugUseDERPHTTP() {
 		proto = "http"
+		port = "3340"
 	}
-	return fmt.Sprintf("%s://%s/derp", proto, node.HostName)
+	if node != nil && node.DERPPort != 0 {
+		port = fmt.Sprint(node.DERPPort)
+	}
+	host := node.HostName
+	if port != "" {
+		host = net.JoinHostPort(node.HostName, port)
+	}
+	return fmt.Sprintf("%s://%s/derp", proto, host)
 }
 
 // AddressFamilySelector decides whether IPv6 is preferred for

--- a/net/netcheck/netcheck.go
+++ b/net/netcheck/netcheck.go
@@ -1103,7 +1103,11 @@
 		go func() {
 			defer wg.Done()
 			node := rg.Nodes[0]
-			req, _ := http.NewRequestWithContext(ctx, "HEAD", "https://"+node.HostName+"/derp/probe", nil)
+			host := node.HostName
+			if node.DERPPort != 0 {
+				host = net.JoinHostPort(node.HostName, fmt.Sprint(node.DERPPort))
+			}
+			req, _ := http.NewRequestWithContext(ctx, "HEAD", "https://"+host+"/derp/probe", nil)
 			// One warm-up one to get HTTP connection set
 			// up and get a connection from the browser's
 			// pool.