Support tunnel, wireguard & possibly more, depending on VIRTIFTYPE[i].
The underlying ip commands are a bit inconsistent on type vs. mode,
but we can hide that with a case statement.  Generalising VIRTIFUSER and
VIRTIFGROUP into VIRTIFARGS is a cop-out, but hopefully intuitive for
the end user.