Add --dns-no-relay and --dns-rate-limit options

Try to battle against common DoS attacks on DNS with added features.

 * Add query limit per second per IP to avoid flood. Once over
   the limit, the IP will be "cool down" for a few minutes.

 * Add option to not relay un-interested domain lookup to upstream
   DNS. For general domain lookup like "baidu.com", we send back a
   "Refused" DNS message immediately, with --dns-no-relay option.
   The getaddrinfo() is supposed to try another DNS server on error.

   So with --dns-no-relay on, the client OS should have some backup
   DNS which will do normal DNS lookup when our DNS return "Refused"
   message. Or it will not gonna be able to resolve most domain
   names!!