Resolve PTR names over DNS-over-HTTPS and cache them for the record TTL (closes #238)

`internal/ptr` asks Google, Cloudflare, AdGuard and Quad9 in turn, 2 seconds in all per address. It keeps answers in memory and writes them through to `cache.db`, opened by the new `internal/cachedb`. A reserved address is not sent to the resolvers.

Judgement calls:
- Each resolver gets an equal share of the time left, so a hung resolver does not use up the 2 seconds.
- The negative TTL is the smaller of the SOA minimum and the SOA's own TTL (RFC 2308).
- Names that are not host names are dropped, as `net.Resolver.LookupAddr` does.

Model: opus-5-5

internal/bogon/bogon.go

@@ -1,5 +1,5 @@
-// Package bogon tells whether a prefix or an AS number is reserved: set aside
-// for a special purpose, so that no network should announce it on the
+// Package bogon tells whether a prefix, an address or an AS number is reserved:
+// set aside for a special purpose, so that no network should announce it on the
 // internet. A route is a bogon announcement when its prefix is reserved or its
 // origin AS is.
 //
@@ -42,6 +42,15 @@ func Prefix(prefix netip.Prefix) (string, bool) {
 	return holder.name + " (" + holder.prefix.String() + ")", true
 }
 
+// Addr returns why addr is reserved, and true, when it lies inside a reserved
+// block, as Prefix decides. An IPv4 address written in IPv6 form counts as the
+// IPv4 address it holds. It returns "" and false when addr is not reserved.
+func Addr(addr netip.Addr) (string, bool) {
+	addr = addr.Unmap()
+
+	return Prefix(netip.PrefixFrom(addr, addr.BitLen()))
+}
+
 // ASN returns why asn is reserved, and true, when it is. It returns "" and
 // false when asn is not reserved.
 func ASN(asn int) (string, bool) {