[Feature] 支持指定网段DNS劫持

[DazeCake]

Verify steps

• 我已经在 Issue Tracker 中找过我要提出的问题 I have searched on the issue tracker for a related issue.
• 我已经使用公测版本测试过，问题依旧存在 I have tested using the test mod, and the issue still exists.
• 我已经仔细看过 常见问题 并无法自行解决问题

Description

目前的dns劫持策略会强行劫持所有链接到代理的dns请求：

udp dport 53 redirect to "$dns_redir_port"
tcp dport 53 redirect to "$dns_redir_port"

这会导致部分场景下出问题：

• lan侧nas在签名证书时，无法及时获取到最新的dns challenge txt。
  是否应该增加劫持指定网段或IP的功能，让lan侧显式指定dns查询服务器的请求能够正常直连？如果可以，我很乐意提交pr

如果有人遇到了相同的问题，可以尝试我的临时解决方案：
修改启动后钩子/etc/ShellCrash/configs/task/afstart并追加

chain="prerouting_dns"
table="shellcrash"
family="inet"
port="${dns_redir_port:-${dns_port:-1053}}"
lan_dev="${lan_dev:-br-lan}"

if nft list chain "$family" "$table" "$chain" >/dev/null 2>&1; then
  handles="$(nft -a list chain "$family" "$table" "$chain" 2>/dev/null | awk '/dport 53 redirect to/ {print $NF}')"
  for handle in $handles; do
    nft delete rule "$family" "$table" "$chain" handle "$handle" 2>/dev/null || true
  done

  router4="$(ip -4 addr show dev "$lan_dev" scope global 2>/dev/null | awk '/inet / {sub(/\/.*/, "", $2); print $2; exit}')"
  if [ -n "$router4" ]; then
    nft add rule "$family" "$table" "$chain" ip daddr "$router4" udp dport 53 redirect to "$port"
    nft add rule "$family" "$table" "$chain" ip daddr "$router4" tcp dport 53 redirect to "$port"
  fi

  ip -6 addr show dev "$lan_dev" 2>/dev/null | awk '/inet6 / {sub(/\/.*/, "", $2); print $2}' | while read -r router6; do
    [ -n "$router6" ] || continue
    nft add rule "$family" "$table" "$chain" ip6 daddr "$router6" udp dport 53 redirect to "$port"
    nft add rule "$family" "$table" "$chain" ip6 daddr "$router6" tcp dport 53 redirect to "$port"
  done

  logger -t shellcrash "custom DNS redirect limited to router DNS destinations on $lan_dev"
fi

这样可以指定只有指向lan的dns请求被劫持，符合dhcp自动下发的直觉，我运行在openwrt上，会加一些本机的公网v6进来，懒得写正则做内网匹配了效果应该是不影响的