[Request]: Minimal nftables support to enable DNS queries on port other than :53

### Feature or enhancement request details

From #436 and apple/container#1809 , I understand there's a desire to let the containers resolve DNS queries w/o relying on the mDNSResponder currently available at gateway IP on port 53. Since it's impossible to assign a port in the nameserver line of /etc/resolv.conf, we need some other way to make that happen.

When I was testing [a custom vminit image](https://github.com/l-hedgehog/aa-tils/pkgs/container/aa-tils%2Fvminitd-ebpf-dns) where this was enabled with eBPF programs (connect4/sendmsg4/recvmsg4), I read about the possibility of `implement the nettlink[sic] support required to do the rule programming` in [apple/container#838](https://github.com/apple/container/discussions/838#discussioncomment-14974098), and decided to give it a try, and I have a work set of patches now.

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Start with the discussions linked from this issue, especially apple/container#838 and the related requests in #436 and apple/container#1809, then review the requester's existing work set of patches and custom vminit image. Done means providing minimal nftables rule-programming support so containers can resolve DNS through a nameserver on a port other than 53.

Written by the indexing model from the issue text.