c-ares: move dns shared resolver logic to upstream cluster

[andy-fong]

Commit Message: c-ares: move dns shared resolver logic to upstream cluster
Additional Description:
In #45073 I added qcache_max_ttl for the c-ares resolver and shared the resolver across clusters with identical c-ares configs so the query cache is shared. However, I didn't realize the UDP DNS filter also calls CaresDnsResolverFactory::createDnsResolver() directly, once per worker thread with that worker's dispatcher. Two workers with the same config would share a resolver bound to the wrong dispatcher, causing c-ares callbacks to fire on the wrong event loop.

Instead of adding a mutex and keying on dispatcher identity, I moved the sharing logic into the upstream cluster layer. The new ClusterDnsResolverCache is owned by ProdClusterManagerFactory (one per server, main thread only), so createDnsResolver() callers like the DNS filter are unaffected and always get their own resolver.

Other notes:

• Sharing remains limited to c-ares; other resolver types get one resolver per cluster as before. The lookup key is hashed at the TypedExtensionConfig level rather than on the unpacked c-ares config.
• The default server-wide resolver (dnsResolver()) is already shared for clusters without a custom resolver config; I deliberately left that path unchanged to minimize scope.
• Because of some workaround people used I found after my original PR merged(see Comment), I decided to leave the envoy.restart_features.shared_cares_dns_resolver to false by default for now.

Also related to #46577

AI Disclosure: this PR is mostly generated by AI with just a few hand edit and updates. I did iterated several times with AI to come up with this solution and understand all the changes.

Risk Level: low
Testing: Added unit tests and also manually tested with tcpdump and the shared resolver feature on and off to confirm the query cache is working to reduce dns lookup to the server.
Docs Changes:
Release Notes: Fixed race caused by shared c-ares dns resolvers.
Platform Specific Features:
[Optional Runtime guard:] "envoy.restart_features.shared_cares_dns_resolver" is set to false by default now

[repokitteh-read-only]

CC @envoyproxy/runtime-guard-changes: FYI only for changes made to (source/common/runtime/runtime_features.cc).

🐱

Caused by: #46657 was opened by andy-fong.

see: more, trace.

[andy-fong]

test failure is unrelated.