Add 'exclude domains' option for .mobileconfig generator

### Prerequisites

- [X] I have checked the [Wiki](https://github.com/AdguardTeam/AdGuardHome/wiki) and [Discussions](https://github.com/AdguardTeam/AdGuardHome/discussions) and found no answer

- [X] I have searched other issues and found no duplicates

- [X] I want to request a feature or enhancement and not ask a question

### Description

#### What problem are you trying to solve?
On iOS, visual voicemail (and presumably some other cell carrier services) by design expect to be resolved by and routed to the cellular provider despite any existing networks or settings. They demand this to work.

If the carrier's visual voicemail domain isn't excluded specifically from any encrypted DNS .mobileconfig, voicemail simply stops working on that phone. I discovered this after using my AGH instance for months, and receiving no voicemails (and missing some appointments!). Switching temporarily to NextDNS, I saw they allow you to exclude domains when generating the config. In my case, I excluded `vvm.ee.co.uk` and `captive.apple.com` and voicemail works again. For now, I have to manually copy over the template for excluding domains from NextDNS to AGH profiles. It would be nice to see this built in.

#### Proposed solution
Add an option box on the `/#guide` DNS privacy tab to allow the user to specify a domain(s) to be excluded from the encrypted DNS profile.

#### Alternatives considered
* Switching to NextDNS.
* Not having voicemail any more(!).

#### Additional information
The 'missing' section in .mobileconfig looks like this:

```
OnDemandRules


Action
EvaluateConnection
ActionParameters


DomainAction
NeverConnect
Domains

vvm.ee.co.uk
captive.apple.com





Action
Connect


```