resolver: a nameserver is asked at each of its addresses in turn (closes #285)

A nameserver's queries went only to the first IPv4 address its name
resolves to, so one unreachable address made it fail whenever that
address came first in the answer. Each record type is now asked at the
addresses one at a time until one gives a usable reply, and the next
type is asked first at the address that gave it. A type that fails is
logged with the reason at each address, and a nameserver is reported as
timed out only when every query timed out; one given no address has
failed. The README's DNS Resolution Strategy says which addresses are
asked.

Model: opus-5-5

internal/resolver/errors.go

@@ -36,6 +36,10 @@ var (
 	// so whether the name has addresses is unknown.
 	ErrNoNameserverAnswered = errors.New("no nameserver answered")
 
+	// ErrNoNameserverAddress is returned when a nameserver is to be
+	// asked and no address for it was given.
+	ErrNoNameserverAddress = errors.New("nameserver has no address")
+
 	// ErrUnusableReply is returned when a server replied with an
 	// error such as SERVFAIL, or with a referral that leads no
 	// closer to the name asked about.