TBS hashes from sdns stamp not verified for DoH

`dnsproxy` doesn't validate sdns hashes for DNS over HTTPS. In [upstream.go](https://github.com/AdguardTeam/dnsproxy/blob/master/upstream/upstream.go#L304-L311) the `stamp.Hashes` value seems to be ignored.

Expected behaviour: Connecting to the Cloudflare sdns://-stamp from the readme shouldn't work, as the hashes don't match any certificate in the chain (anymore).
Actual behaviour: Pinned certificate hash seems to be ignored and `dnsproxy` connects.

**Reproducer**

Connecting to Cloudflare DNS as shown in the readme.

```bash
# hashes: 10d93c9864a521f3065cc3a522509c2afabb01581cad9c6d8e89fdd75f9ea747,eb7525f88f0d9458f81a995019bfd34cb89ccdc957e7b0ef315f10f897638118
./dnsproxy -v -p 8053 -u sdns://AgcAAAAAAAAABzEuMC4wLjGgENk8mGSlIfMGXMOlIlCcKvq7AVgcrZxtjon911-ep0cg63Ul-I8NlFj4GplQGb_TTLiczclX57DvMV8Q-JdjgRgSZG5zLmNsb3VkZmxhcmUuY29tCi9kbnMtcXVlcnk
[...]
2026/06/15 16:05:20.992950 DEBUG set upstream idx=0 addr=https://dns.cloudflare.com:443/dns-query
[...]
2026/06/15 16:05:50.251435 DEBUG handling new udp packet prefix=dnsproxy raddr=127.0.0.1:55080
2026/06/15 16:05:50.251596 DEBUG in prefix=dnsproxy line_num=1 line=";; opcode: QUERY, status: NOERROR, id: 30052"
```

Current certificates of cloudflare according to `dnscrypt-proxy`:

```bash
./dnscrypt-proxy -show-certs
[...]
[2026-06-15 16:04:19] [NOTICE] Advertised cert: [CN=dns.cloudflare.com] [0be6a7a50e9d4e55f98efc453c50000a5a84fe463e646637d0dbc480628f396d]
[2026-06-15 16:04:19] [NOTICE] Advertised cert: [CN=WE1,O=Google Trust Services,C=US] [5dcef11ccfce2d2fa41c47bf2debd91cd27b9f6e5c986a5e5d8b5d009fa4b250]
[2026-06-15 16:04:19] [NOTICE] Advertised cert: [CN=GTS Root R4,O=Google Trust Services LLC,C=US] [6e62a0efd60a04d93f2f864b54442717a666c038c8c70546af6319e4f46a2f73]
[2026-06-15 16:04:19] [CRITICAL] [cf-1] Certificate hash [eb7525f88f0d9458f81a995019bfd34cb89ccdc957e7b0ef315f10f897638118] not found
```