feat(dns): clarify resolver transport security

[ryanfowler]

Summary

• report resolver transport security separately from DNSSEC semantics
• correctly classify DoT, DoQ, DoH, UDP, TCP, and platform resolver paths
• keep plaintext HTTP and legacy resolver URLs accurate
• add coverage and document that fetch does not validate DNSSEC

Validation

• go test -v -parallel 8 ./...
• staticcheck ./...
• go build .
• gofmt and git diff --check