wireguard: introduce 'nohostroute' option