dns proxy: port DNS64 synthesis to master

Port the reviewed DNS64 behavior while preserving master's context-aware
resolver, cache, logging, and Firewall Mode flow.

internal/dnscache/cache.go

@@ -29,6 +29,7 @@ type Key struct {
 	Name     string
 	Upstream string
 	ECS      string
+	Variant  string
 }
 
 type Value struct {
@@ -71,6 +72,14 @@ func NewKey(msg *dns.Msg, upstream string) Key {
 	return Key{Qtype: q.Qtype, Qclass: q.Qclass, Name: normalizeQname(q.Name), Upstream: upstream, ECS: CanonicalECS(msg)}
 }
 
+// NewVariantKey creates a cache key in a named result variant. Variants keep
+// derived answers separate from the upstream's answer to the same question.
+func NewVariantKey(msg *dns.Msg, upstream, variant string) Key {
+	key := NewKey(msg, upstream)
+	key.Variant = variant
+	return key
+}
+
 // CanonicalECS returns a canonical string form of the EDNS Client Subnet (ECS,
 // EDNS option 8) carried by msg, suitable for partitioning cache and
 // singleflight keys. A request with no ECS option returns "", so all ECS-less