feat: add configurable rule matching engine

Implement MatchingEngine in internal/rulematcher package to enable
configurable DNS policy rule evaluation order and behavior.

New components:
- MatchingConfig: Configuration for rule order and stop behavior
- MatchingEngine: Orchestrates rule matching with configurable order
- MatchingResult: Standardized result structure
- DefaultMatchingConfig(): Maintains backward compatibility

Key features:
- Configurable rule evaluation order (e.g., domain-first, MAC-first)
- StopOnFirstMatch configuration option
- Graceful handling of invalid rule types
- Comprehensive test coverage for all scenarios

The engine supports custom matching strategies while preserving
the default Networks → Macs → Domains order for backward compatibility.
This enables future configuration-driven rule matching without
breaking existing functionality.

internal/rulematcher/types.go

@@ -38,3 +38,18 @@ type MatchResult struct {
 	MatchedRule string
 	RuleType    RuleType
 }
+
+// MatchingConfig defines the configuration for rule matching behavior
+type MatchingConfig struct {
+	Order            []RuleType `json:"order" yaml:"order"`
+	StopOnFirstMatch bool       `json:"stop_on_first_match" yaml:"stop_on_first_match"`
+}
+
+// DefaultMatchingConfig returns the default matching configuration
+// This maintains backward compatibility with the current behavior
+func DefaultMatchingConfig() *MatchingConfig {
+	return &MatchingConfig{
+		Order:            []RuleType{RuleTypeNetwork, RuleTypeMac, RuleTypeDomain},
+		StopOnFirstMatch: true,
+	}
+}