Fix add_tag behaviour in dns filter

The filter should only modify the event's fields and tags if and only if
all resolves/reverses succeed. So we clone the event, modify the new
copy and return it if all operations succeed. Otherwise the original
event is not modified.

For performance reasons we could reverse the clone logic: clone the
event, modify the original event and, it case of failure, return the
backup.
Fixes #1785 
Note: this changes the dns filter behaviour towards `add_tag`