fix(cache): isolate client_ip-scoped static responses from dns_cache

[olicesx]

Summary

• Static decisions from pipelines that use a client_ip matcher no longer write to dns_cache, whose key has no client dimension and could leak cached answers across clients
• rule_cache already caches static decisions with client-IP isolation, so caching remains correct
• Add a response-action path test for static_ip_response qtype filtering (A/AAAA/HTTPS)
• Document the UDP response size limit for large address lists

Background

Follow-up to review findings on PR #36:

• dns_cache's dedupe_hash does not include client_ip. When a pipeline rule uses a client_ip matcher and produces a static decision, the first client's static answer could be served to a different client via the DNS cache.
• handle_static_decision now skips dns_cache insertion when the pipeline uses a client_ip matcher. Rule-cache isolation (key + entry + match) already covers this case, so there is no caching regression.

Behavior

• Pipeline with client_ip matcher + static_ip_response: answer is built per query, cached in rule_cache (client-isolated), and never entered into dns_cache
• Pipeline without client_ip matcher: unchanged (dns_cache caching as before)
• Response-action path (apply_response_actions) covered by a new test for qtype filtering

Validation

• cargo fmt --all -- --check
• cargo test (120 unit tests, 6 listener tests, 9 DoH integration tests, 10 doctests)
• cargo clippy --all-targets --all-features -- -D warnings
• git diff --check