home: keep check-config read-only

[Sil3ntVip3r]

Summary

• propagate a read-only mode through configuration migration when
  --check-config is used
• migrate and validate legacy schemas in memory without rewriting
  AdGuardHome.yaml
• preserve legacy dnsfilter.txt and Corefile inputs during validation
• leave normal startup migration and cleanup behavior unchanged

Testing

• focused migration/parser regressions, 20 times under -race
• full internal/configmigrate and internal/home packages under -race
• real-binary old-schema smoke test: successful validation with identical
  hashes, sizes, modes, and mtimes for all migration inputs and no new files
• Windows amd64 cross-compilation of both affected test packages
• make go-check
• git diff --check

Fixes #4067.

[Sil3ntVip3r]

Resolved the only integration conflict by merging current upstream master (b2e25729) into this branch. The conflict was confined to CHANGELOG.md; current master’s configuration-path changes auto-merged with the read-only --check-config behavior.

Validation on exact head 17d4011de3be6c3b3ae063148f323dd976db3c28:

• read-only migration/parser regressions: 20 runs under -race;
• go test -race -count=1 ./internal/configmigrate ./internal/home;
• real binary --check-config smoke test: old YAML plus dnsfilter.txt and Corefile retained identical hashes, sizes, modes, and timestamps;
• Windows amd64 cross-compilation of both affected test packages;
• make go-check, make md-lint txt-lint, and whitespace checks.

GitHub now reports this PR as mergeable.