Consider porting dnscrypt-proxy's blocked_names feature to dnsproxy.

https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-blocked-names.txt

This one checks `domain name` AND `resolved CNAME`s. For example if there is "ads.com" listed:

```
target-ads.example.com CNAME cdn1.gateway.com
cdn1.gateway.com CNAME adcdn.ads.com <-----------------
adscdn.ads.com CNAME wildadservice.com
wildadservice.com A 1.2.3.4
```

Then this will return 0.0.0.0/::0.

Start with the linked `dnscrypt-proxy/example-blocked-names.txt` to match expected semantics. Then inspect dnsproxy’s blocked-domain configuration and DNS query resolution path to locate where domain filtering and CNAME handling are done. Add or update focused tests around the provided ads.com/CNAME chain so the behavior returns 0.0.0.0 or ::0, and mark done when that end-to-end case is covered.

由索引模型根据 Issue 内容生成。