DNS Filter spec should always mock the call to the resolv library Fix: #1875

Fixes #1
missing mock

Fixes #1
useless backup

Fixes #1
Fix add_tag behaviour in dns filter

The filter should only modify the event's fields and tags if and only if
all resolves/reverses succeed. So we clone the event, modify the new
copy and return it if all operations succeed. Otherwise the original
event is not modified.

For performance reasons we could reverse the clone logic: clone the
event, modify the original event and, it case of failure, return the
backup.

Note: this changes the dns filter behaviour towards add_tag

Fixes #1
DNS is up to date with the lastest version from master

Fixes #1