GeoSite / GeoIP split-tunneling

### Issue Details

AdGuard VPN does not have simple and quick settings for selective routing (split-tunneling) by country or domain category: one rule cannot exclude such traffic from a VPN or, conversely, direct it through a VPN. This is important in situations, when the VPN is turned on, the national websites of the country where the user is located stop opening (downloading).

### Proposed solution

Many modern VPN clients have "country-based" traffic routing (split-tunneling): for each connection, the client decides according to the rules whether to send traffic via VPN /proxy, directly (direct) or block (block).

The country is not "guessed". The client maps the destination address (IP and/or domain) to a set of rules that are stored locally or downloaded:
- GeoIP (geoip.dat / rule-set) — lists of IP ranges (CIDR) grouped by country (RU/CN/US, etc.), sometimes also by ASN, provider, or category.
- GeoSite (geosite.dat / rule-set) — lists of domains grouped by geography or by services/categories (for example, `geolocation-ru`, `google`, `ads`). The "geosite as domain lists for routing" approach has historically been associated with the Project V domain-list-community.

Example: in Direct mode, you can exclude websites from a certain country from the tunnel using rules like `geosite:category-gov-ru` and `geosite:category-ru`.

### Alternative solution

_No response_