Resolve PTR names over DNS-over-HTTPS and cache them for the record TTL (closes #238)

`ptr` keeps its field and shape. It now comes from Google, Cloudflare, AdGuard and Quad9 over RFC 8484, tried in turn within 2 seconds, in place of the host's resolver with no cache. Answers stay in memory and in a new `cache.db` for the record's TTL, at most 250,000 addresses. A reserved address is not sent to any resolver and has an empty `ptr`.

Judgement call: each resolver gets an equal share of the time left, so a hung one does not use up the limit.
Judgement call: the negative TTL is the smaller of the SOA minimum and the SOA's own TTL.
Deviation: the cache is SQLite, by sneak's words, not the JSON file the standing rule asks for.

Model: opus-5-5

internal/bogon/bogon.go

@@ -1,5 +1,5 @@
-// Package bogon tells whether a prefix or an AS number is reserved: set aside
-// for a special purpose, so that no network should announce it on the
+// Package bogon tells whether a prefix, an address or an AS number is reserved:
+// set aside for a special purpose, so that no network should announce it on the
 // internet. A route is a bogon announcement when its prefix is reserved or its
 // origin AS is.
 //
@@ -42,6 +42,15 @@ func Prefix(prefix netip.Prefix) (string, bool) {
 	return holder.name + " (" + holder.prefix.String() + ")", true
 }
 
+// Addr returns why addr is reserved, and true, when it lies inside a reserved
+// block, as Prefix decides. An IPv4 address written in IPv6 form counts as the
+// IPv4 address it holds. It returns "" and false when addr is not reserved.
+func Addr(addr netip.Addr) (string, bool) {
+	addr = addr.Unmap()
+
+	return Prefix(netip.PrefixFrom(addr, addr.BitLen()))
+}
+
 // ASN returns why asn is reserved, and true, when it is. It returns "" and
 // false when asn is not reserved.
 func ASN(asn int) (string, bool) {