hardening: validate EXTERNAL_RESOLVER as IP addresses

[dash14]

Summary

EXTERNAL_RESOLVER decides where every allowed name is resolved, and its value is substituted straight into the generated HAProxy config and into /etc/resolv.conf. It was never checked to be an address, so a value carrying a newline could open a directive of its own in the file it landed in. Each engine now refuses anything that is not an IP address, and takes the container down with it rather than starting on a config it did not generate.

Changes

• universal: init-haproxy-cfg validates every entry before building the nameserver lines.
• inspect: init-inspect-cfg validates the list before handing it to the config generator.
• explicit: resolvConf is split out of writeResolvConf and validates each entry with netip.ParseAddr.
• Commas and whitespace are both accepted as separators everywhere, which universal and inspect previously disagreed on.

Test plan

• A value carrying a newline and a bind directive takes the container down at startup with a message naming the offending entry, instead of reaching the config.