wireguard: add checkbox for `nohostroute` option