-k/--insecure does not affect DNS resolution

[ainar-g]

• The command (edited for privacy):

  gocurl --dns-servers 'tls://dns.localhost' -k -v 'https://web.localhost/'

  (Both addresses are set to be 127.0.0.1 through /etc/hosts.)

• Expected: A successful query despite the local certificate being self-signed.

• Actual:

  Connecting to web.localhost:443
  Connecting to tcp://web.localhost:443
  Resolving IP addresses of dns.localhost
  Failed to make request: empty response
  dns lookup: getting conn to tls://dns.localhost:443: connecting to dns.localhost: tls: failed to verify certificate: x509: certificate signed by unknown authority
  dns lookup: getting conn to tls://dns.localhost:443: connecting to dns.localhost: tls: failed to verify certificate: x509: certificate signed by unknown authority
  

• Proposed solution: curl has a separate --doh-insecure flag. Perhaps either use that or add a new flag like --dns-insecure to disable TLS verification for all DNS queries.