systemd-resolved: a machine's own resolver, routing a VPN's domains by link (hq ADR 0247)

Holds node-resolver and provides split-dns at the machine's reach, for a
machine whose VPN client pushes resolvers of its own. It writes the
resolver file naming the machine's private address, gives resolved the
mesh's resolvers as the default route, and serves routes, route and unroute
on the mesh and, over a root-only socket, on the machine. Its guard keeps an
outside write of the file for the module that handles it and puts the
module's file back: at once when taken, after 90 s otherwise, so a write
nothing declared to handle is still raised by the node-engine.

modules/systemd-resolved/go.mod

@@ -0,0 +1,5 @@
+module systemd-resolved
+
+go 1.25.0
+
+require git.novox.be/novox/mesh-sdk/go v0.1.7