feat(linux-sandbox): add policy-checked DNS relay

[viyatb-oai]

Summary

• compile the managed allow and deny lists into the same normalized domain matcher used by the proxy
• resolve only permitted A, AAAA, and CNAME queries through the host resolver without forwarding sandbox DNS packets
• refuse malformed, multi-question, unsupported, and PTR queries, and emit canonical names only when they are also permitted
• relay UDP and TCP DNS framing over inherited Unix streams and exit when those channels close

Testing

• cargo test --offline in an isolated DNS module harness (3 passed)
• just fix -p codex-network-proxy -p codex-linux-sandbox

Stack: 2 of 5, on #31642.