refactor: extract rule matching logic into internal/rulematcher package

Extract DNS policy rule matching logic from dns_proxy.go into a dedicated
internal/rulematcher package to improve code organization and maintainability.

The new package provides:
- RuleMatcher interface for extensible rule matching
- NetworkRuleMatcher for IP-based network rules
- MacRuleMatcher for MAC address-based rules
- DomainRuleMatcher for domain/wildcard rules
- Comprehensive unit tests for all matchers

This refactoring improves:
- Separation of concerns between DNS proxy and rule matching
- Testability with isolated rule matcher components
- Reusability of rule matching logic across the codebase
- Maintainability with focused, single-responsibility modules

internal/rulematcher/types.go

@@ -0,0 +1,40 @@
+package rulematcher
+
+import (
+	"context"
+	"net"
+
+	"github.com/Control-D-Inc/ctrld"
+)
+
+// RuleType represents the type of rule being matched
+type RuleType string
+
+const (
+	RuleTypeNetwork RuleType = "network"
+	RuleTypeMac     RuleType = "mac"
+	RuleTypeDomain  RuleType = "domain"
+)
+
+// RuleMatcher defines the interface for matching different types of rules
+type RuleMatcher interface {
+	Match(ctx context.Context, request *MatchRequest) *MatchResult
+	Type() RuleType
+}
+
+// MatchRequest contains all the information needed for rule matching
+type MatchRequest struct {
+	SourceIP  net.IP
+	SourceMac string
+	Domain    string
+	Policy    *ctrld.ListenerPolicyConfig
+	Config    *ctrld.Config
+}
+
+// MatchResult represents the result of a rule matching operation
+type MatchResult struct {
+	Matched     bool
+	Targets     []string
+	MatchedRule string
+	RuleType    RuleType
+}