denoland#34236)

`fetch()` and `WebSocket` both ran the static `check_net_url` and then
handed the URL to hyper, whose DNS resolver in `ext/fetch/dns.rs`
returned addresses straight to the connector. That meant a hostname
like `localhost` could pass the URL check and still connect to a denied
IP after DNS lookup. `Deno.connect`, `Deno.listen`, and friends already
run `check_net_resolved` on every resolved address in `ext/net/ops.rs`;
the HTTP/WS paths were the odd ones out.

Thread the `PermissionsContainer` through to the fetch DNS resolver and
run the same post-resolution check on each address before yielding it
to the HTTP connector. Applies to the default client, clients created
via `Deno.createHttpClient`, and any custom `Resolve` implementation.

WebSocket reuses the fetch HTTP client, so the default and
custom-client paths inherit the fix automatically. The one remaining
gap was `create_client_from_websocket_options` (used when a WebSocket
is opened with `ca_certs` or `unsafelyIgnoreCertificateErrors`), which
built a `deno_fetch::Client` directly without threading permissions.
Patched to mirror `create_client_from_options` in `ext/fetch`.

…34418)

Follow-up to #34236, addressing
#34236 (comment).

#34236 introduced a `REQUEST_PORT` `tokio::task_local!` to smuggle the
real destination port from `PermissionedHttpConnector` (which sees the
`Uri`) into the DNS resolver (which is only handed a `Name` by
hyper-util's `HttpConnector`). The DNS resolver then ran the
post-resolution net-deny check against every resolved address with that
port. This was load-bearing but pretty ugly: it relied on the task-local
being read before each `tokio::spawn` inside the resolver and scoped
around the inner connector's future.

Instead, run both the resolution and the check in
`PermissionedHttpConnector` itself, which sees the full `Uri` (and
therefore the real port). The connector now owns the `Resolver` and the
connector config (local address) rather than a pre-built
`HttpConnector`:

- For hostnames, it resolves via the `Resolver`, checks every resolved
  address with `check_net_resolved` before any socket is opened
  (matching what `Deno.connect` does in `ext/net/ops.rs`), and then
  hands the vetted addresses to a hyper-util `HttpConnector` through a
  pre-resolved resolver. The connection goes to exactly the addresses
  that were checked, so no second DNS query can race with a record
  change.
- For IP-literal hosts, the literal is checked directly and resolution
  is skipped (hyper-util connects to literals without consulting the
  resolver).
- Resolution errors are wrapped in a `DnsError` type that mirrors
  hyper-util's `ConnectError` display ("dns error" with the `io::Error`
  as source), so fetch error messages keep their existing
  `client error (Connect): dns error: ...` format.

This removes the `REQUEST_PORT` task-local, the `permissions` field on
`Resolver`, `Resolver::with_permissions`, and the in-resolver
`check_resolved_permissions` helper. Callers pass
`permissions: Option<PermissionsContainer>` via
`CreateHttpClientOptions`, and `ext/fetch` and `ext/websocket` set it
there.

No behavior change for the existing `tests/specs/permission/deny_net_*`
regression tests.

## Follow-up: proxied request destinations

A request routed through a proxy only opens a socket to the proxy, so
the post-resolution deny check on the connector previously only saw the
proxy address. An IP-level `--deny-net` rule on the destination could
therefore be bypassed by routing through an allowed proxy.

`ProxyConnector` now runs a best-effort net-deny check against the real
destination before connecting to the proxy: it resolves the destination
host (via the new `CheckDst` trait on `PermissionedHttpConnector`) and
checks every resolved address. It is best-effort because a proxy may be
able to reach a host this process cannot resolve locally, so a local
resolution failure is not fatal; the connection to the proxy itself is
still checked separately. Covered by a new `ext/fetch` test that denies
a proxied destination whose hostname resolves to a denied IP.