chore(restrictednet): add internal/restrictednet package

[qdm12]

See #3358

[Copilot]

Pull request overview

Introduces a new internal/restrictednet package intended to perform DNS-over-HTTPS name resolution and HTTPS requests while temporarily opening highly-restrictive outbound firewall rules (scoped by source IP/port and destination IP/port), supporting the “restricted internet when VPN tunnel is down” workflow referenced in #3358.

Changes:

• Add internal/restrictednet client APIs for DoH-based name resolution and for opening temporary HTTPS egress rules.
• Extend the firewall abstraction and iptables implementation with AcceptOutputFromIPPortToIPPort.
• Add unit tests and mock generation for the new package, plus update agent guidance in AGENTS.md.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
internal/restrictednet/client.go	Adds Client constructor and OpenHTTPSByDomain helper wiring DoH resolution to HTTPS rule opening.
internal/restrictednet/https.go	Implements HTTPS client creation with bound dialing and temporary firewall rule add/remove.
internal/restrictednet/resolve.go	Implements DoH POST queries and parsing DNS answers into netip.Addr results.
internal/restrictednet/client_test.go	Adds unit test coverage for OpenHTTPS firewall rule add/remove behavior.
internal/restrictednet/resolve_test.go	Adds unit test coverage for parsing DNS answers into netip.Addr.
internal/restrictednet/interfaces.go	Defines the Firewall interface used by restrictednet.
internal/restrictednet/mocks_generate_test.go	Adds go:generate directive for GoMock generation.
internal/restrictednet/mocks_test.go	Adds generated GoMock for the restrictednet Firewall interface.
internal/firewall/wrappers.go	Exposes a new wrapper method on firewall.Config.
internal/firewall/interfaces.go	Extends the internal firewall implementation interface with the new accept rule method.
internal/firewall/iptables/iptables.go	Adds iptables/ip6tables rule generation for source+dest IP/port-specific output acceptance.
AGENTS.md	Updates repository agent/coding guidance with additional preferences.

Files not reviewed (1)

• internal/restrictednet/mocks_test.go: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated 4 comments.

Files not reviewed (1)

• internal/restrictednet/mocks_test.go: Language not supported

[Copilot]

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated 7 comments.

Files not reviewed (1)

• internal/restrictednet/mocks_test.go: Language not supported

[Copilot]

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

• internal/restrictednet/mocks_test.go: Language not supported

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

• internal/restrictednet/mocks_test.go: Language not supported