webserver: serve DoH natively in the terminator over HTTP/1.1, /2 and /3

CivetWeb's request handling added tens of milliseconds to each DoH query, so
`/dns-query` is served directly in the front terminator instead of being relayed
to CivetWeb. A minimal HTTP implementation parses GET and POST (RFC 8484) over
HTTP/1.1, HTTP/2 and HTTP/3 and resolves through `dotdoh_server_resolve()`,
bringing DoH down to ~2 ms/query. HTTP/3 resolves off the QUIC event loop on a
small worker pool, so one slow resolve cannot stall other connections. TCP_NODELAY
on the terminator's client sockets avoids a ~40 ms delayed-ACK stall on the small
TLS responses.

The surface is deliberately small and bounded: requests are read non-blocking
against an absolute deadline (no slow-drip pin), `Transfer-Encoding` is refused,
bodies are size-capped, connections are limited per source, a 405 carries
`Allow`, and `Expect: 100-continue` is honored. Plain-HTTP `/dns-query` gets 426
and a misdirected encrypted request 421. With DoH no longer on CivetWeb, the
terminator learns the connected address directly and injects it as the private
EDNS option, so `pi.hole` localisation over DoH is unchanged; the base client
PROXY v2 stays for the UI and API.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Author: DL6ER