feat: add DNSSEC validation

[0xERR0R]

closes #1287

[codecov]

Codecov Report

❌ Patch coverage is 83.22546% with 311 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.54%. Comparing base (ac8ca7d) to head (77eb056).
⚠️ Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
resolver/dnssec_validator.go	78.64%	142 Missing and 35 partials ⚠️
resolver/dnssec/chain.go	80.09%	39 Missing and 5 partials ⚠️
resolver/dnssec/nsec3.go	80.58%	34 Missing and 6 partials ⚠️
resolver/dnssec/validator.go	88.19%	15 Missing and 4 partials ⚠️
resolver/dnssec/wildcard.go	81.53%	8 Missing and 4 partials ⚠️
resolver/dnssec_trust_anchors.go	85.18%	4 Missing and 4 partials ⚠️
resolver/dnssec/denial.go	68.42%	6 Missing ⚠️
resolver/dnssec_resolver.go	94.36%	4 Missing ⚠️
resolver/dnssec/rrset.go	98.71%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1914      +/-   ##
==========================================
- Coverage   93.13%   90.54%   -2.60%     
==========================================
  Files          79       92      +13     
  Lines        5156     7010    +1854     
==========================================
+ Hits         4802     6347    +1545     
- Misses        248      499     +251     
- Partials      106      164      +58     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull Request Overview

This PR introduces comprehensive DNSSEC validation support for DNS responses. The implementation adds a new DNSSEC resolver that validates signatures, walks the chain of trust from root to target domains, and handles both NSEC and NSEC3 denial of existence proofs.

Key changes:

• DNSSEC validation with configurable trust anchors
• Support for NSEC and NSEC3 denial of existence
• DoS protection via query budgets and iteration limits
• Comprehensive test coverage with 5000+ lines of tests

Reviewed Changes

Copilot reviewed 41 out of 44 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
server/server.go	Integrates DNSSEC resolver into resolver chain before caching
resolver/dnssec_validator.go	Core DNSSEC validation logic (1930 lines)
resolver/dnssec_validator_test.go	Comprehensive test suite (5045 lines)
resolver/dnssec_trust_anchors.go	Trust anchor store with default root KSKs
resolver/dnssec_resolver.go	Resolver wrapper that performs validation
resolver/dnssec_validator_enum.go	Generated enum for validation results
resolver/dnssec/validator_enum.go	Generated enum in dnssec package
log/mock_entry.go	Added thread-safety to mock logger

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

@0xERR0R I've opened a new pull request, #1920, to work on those changes. Once the pull request is ready, I'll request review from you.