feat: move dns lookup to run independently

[0xzrf]

Summary of Changes

• Describe what changed in the PR

  Introduced a DeliveryDNSRefresher that runs DNS for result-destination host:port strings outside the measurement loop: it refreshes on a 5-minute ticker, once at startup, and whenever the desired set of destinations changes (after outbound or ICMP target discovery updates). The measurement/send path now uses DNSCache.LookupDeliveryUDPAddr, which never performs LookupHost for hostnames—it only returns an address if the cache is already populated and still valid; literal public IPs are still resolved synchronously with the existing ValidateScope() checks. sendCompositeOffsets uses deliveryDNS.Lookup instead of dnsCache.Resolve, so slow or timing DNS no longer runs inside the RTT/measurement cycle. If a hostname is not ready yet, that target is skipped for that cycle with a warning log.

• Explain why the change is necessary
  Due to: geolocation: move geoprobe-agent DNS lookups out of measurement loop #3544

• Is there supporting documentation or external resources that explain the change? No

• Is a CHANGELOG.md update needed? No

Testing Verification

• go test on controlplane/telemetry/internal/geoprobe for DNSCache_*, DeliveryDNS_*, and LookupDelivery* tests: pass (covers startup refresh, coalesced refresh after SetDesiredHostPorts, literal-IP lookup without waiting, domain miss before refresh, cache hit/miss/TTL, private IP rejection, invalid host:port).
• GOOS=linux go build ./controlplane/telemetry/cmd/geoprobe-agent/: succeeds (agent is //go:build linux).
• Note: go test ./controlplane/telemetry/cmd/geoprobe-agent/... may fail on macOS because main_test.go is not tagged linux while main.go is—run agent package tests on Linux / CI for a full green check.