tests: extend wireguard test to cover incremental allowed-ips updates

New +/- syntax in wg(8) allows us to add or remove just a single
allowed-ip rather than forcing replacement or weird tricks to do an
atomic removal. Ensure that it works now that we've added kernel
support for it.

Reviewed by: ivy

(cherry picked from commit 716b6667b65b50c15900be9f88cc67f2326872b4)