Fix node:dns lookup CNAME filtering

[xgame92]

Summary

• filter DNS-over-HTTPS answers by A/AAAA record type before returning node:dns lookup results
• preserve ENOTFOUND behavior when no matching address records remain
• add regression coverage for CNAME chains across combined and explicit family lookups

Fixes #6886

Testing

• bazel test //src/workerd/api/node/tests:dns-nodejs-test@ --test_output=errors --nocache_test_results
• bazel build //src/node:node@tsproject
• pnpm exec eslint --config src/node/eslint.config.mjs src/node/internal/internal_dns.ts src/workerd/api/node/tests/dns-nodejs-test.js
• pnpm exec prettier --check src/node/internal/internal_dns.ts src/workerd/api/node/tests/dns-nodejs-test.js

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[xgame92]

Could an assigned reviewer please run the internal build workflow for this external contribution? The local native DNS target and TypeScript checks are included in the PR description. Thank you.

[xgame92]

I have read the CLA Document and I hereby sign the CLA

[xgame92]

recheck

[xgame92]

recheck

[jasnell]

Overall, this is good but I think it needs to go a bit further. I think all the resolve* methods likely have this issue. Worth a check before this proceeds.

Will leave other comments inline directly

[jasnell]

Needs to use a generic name, something in the example.org family, perhaps?

[xgame92]

Updated this to www.iana.org. The example.* hosts currently return direct A/AAAA answers, so they do not exercise the CNAME-chain case.

[jasnell]

Nit: these are likely better defined in internal_dns_client

[xgame92]

Moved the RR type mapping into internal_dns_client and now filter Answer there using the requested type. That makes the filtering apply to lookup, every implemented resolve* method, and reverse.

[xgame92]

I checked the full resolver surface and moved the filtering into sendDnsRequest(), so every caller now receives only the requested RR type. The regression coverage now uses www.iana.org and exercises lookup(), resolve4(), and resolve6(). The full dns-nodejs-test@ target, including the existing tests for each implemented resolve* method, passes locally.

[xgame92]

@jasnell Thanks for the review and approval. Could you please run the internal build workflow for this external contribution when convenient? The automated check cannot run for non-org forks.