core/dnsserver: add Config.UDPDecorateWriterFunc for external plugins (#8257)

* core/dnsserver: add Config.UDPDecorateWriterFunc for external plugins

Allow external plugins to install a dns.DecorateWriter (an existing
miekg/dns Server field CoreDNS never sets) on plain-UDP servers, e.g.
for per-socket write disciplines or overload protection; UDP is the
only transport without a Max*-style concurrency setting.

The field is a factory called once per Server in ServePacket, so each
socket gets its own decorator under multisocket; the *Server argument
is the same value handlers see via ctx.Value(dnsserver.Key{}). Follows
the Config.HTTPRequestValidateFunc precedent, including server-block
propagation and the ServePacket-time lookup over s.zones. Nil (the
default) changes nothing.

Signed-off-by: Ryan Brewster <rpb@anthropic.com>

* core/dnsserver: select UDP writer decorator deterministically in NewServer

Review feedback: s.zones is a map, so choosing the decorator in
ServePacket was non-deterministic when several server blocks share a
listener. Select it in NewServer from the group slice instead (stable
config order, last one set wins) and document the resolution order.

Signed-off-by: Ryan Brewster <rpb@anthropic.com>

* core/dnsserver: group decorator selection with the other last-writer-wins fields

Pure move: place it next to ProxyProtoConnPolicy, the existing field
resolved the same way at the same point.

Signed-off-by: Ryan Brewster <rpb@anthropic.com>

---------

Signed-off-by: Ryan Brewster <rpb@anthropic.com>

core/dnsserver/config.go

@@ -11,6 +11,7 @@ import (
 	"github.com/coredns/coredns/plugin"
 	"github.com/coredns/coredns/request"
 
+	"github.com/miekg/dns"
 	"github.com/pires/go-proxyproto"
 )
 
@@ -49,6 +50,15 @@ type Config struct {
 	// may depend on it.
 	HTTPRequestValidateFunc func(*http.Request) bool
 
+	// If this function is not nil it is called once per Server in ServePacket
+	// (so each UDP listening socket gets its own decorator under multisocket)
+	// and its result is installed as the underlying dns.Server's
+	// DecorateWriter. Plain dns:// UDP listeners only. When several server
+	// blocks sharing a listener set it, the last one in config order wins.
+	// Although this isn't referenced in-tree, external plugins may depend
+	// on it.
+	UDPDecorateWriterFunc func(*Server) dns.DecorateWriter
+
 	// FilterFuncs is used to further filter access
 	// to this handler. E.g. to limit access to a reverse zone
 	// on a non-octet boundary, i.e. /17