feat(dns): add address filter

[JasonColapietro]

Summary

• add an optional filter(origin, record) policy hook to the DNS interceptor
• apply the policy to every resolved address and to literal IPv4 and IPv6 origins before connecting
• keep enforcement active for fetch redirects and when the DNS cache has reached maxItems
• document the application-owned policy boundary and expose the hook in the TypeScript definitions

This builds on the existing DNS interceptor so accepted hostnames are resolved once and the connection uses the accepted literal address while preserving the original Host header and TLS servername. Undici does not classify public or private ranges; callers supply that policy.

Closes #2019.

Validation

• npm run test:interceptors (316 passed, 3 skipped)
• npm run test:typescript
• npm run lint
• git diff --check