Resolve test DNS in-process, drop external tag

[hyperxpro]

Motivation:

The scheduled Build Check has been red since 2026-08-04 while the PR build stayed green. The two AddressResolverGroupTest methods that need a real DNS query were tagged external and reached www.google.com, so only the nightly ran them. Since 2216 the client auto-selects epoll or kqueue when the native library is present, and the test still built its DnsAddressResolverGroup on NioDatagramChannel. Netty refuses to register that channel on a native loop, and every real lookup failed with incompatible event loop type. The PR build never executed that path, which is how it shipped in 3.0.12 hrough 3.0.14.

Modification:

Add StubDnsServer, an in-process Netty UDP responder that answers A queries with 127.0.0.1 and nonexistent.invalid with NXDOMAIN. Point the resolver tests at it and derive the datagram channel from the transport the client actually selects.

Assert the NXDOMAIN response code on the unknown-host test instead of any non-null cause. Remove the external tag, the excludedGroups property and profile, and the -Dexternal.tests flag from Build Check; the proxy Testcontainers classes have used a local nginx since #2299 and only need Docker. Give Build Check workflow_dispatch and the same test commands as the PR workflow. Document on setAddressResolverGroup that the datagram channel must match the transport.

Result:

No test reaches the public internet. The resolver tests issue genuine DNS queries on every OS in every PR build, and a transport mismatch now fails three of them in the default suite instead of passing silently.