Build or embed a DNS server to filter allowed external hostnames

It is non-trivial to manage outbound security rules using IP addresses, as many external websites rely on load balancers and volatile IP addresses on top of clouds.

Let's build a DNS server that provides transparent access to whitelist domains (e.g., github.com) from user kernel sessions but returns "unresolved" results for other domains.
This would not be perfect but will provides a good starting point.

The issue names no files, tests, or entry points, so start by surveying the repository structure and existing sandbox networking controls. Define how a DNS service would integrate with user kernel sessions, then verify that whitelisted domains resolve while other external domains return unresolved results.

Written by the indexing model from the issue text.