make inter-package recommendations tightly versioned

Some prior versions of wireguard might not be compatible with the
kernel module.  We'd prefer to have the same version of both the
kernel module and the userspace tools.

we use source:Version instead of binary:Version to permit binary-only
uploads to affect the architecture-dependent tools package but not the
arch-independent dkms package (or vice versa)