layers/dns: preserve wire label boundaries for names with literal dots (DNS-SD/mDNS)

[gainskills]

Problem

gopacket decodes DNS names to dotted []byte and the serializer rebuilds the wire
name by splitting on every .. That corrupts any DNS name whose single label
contains a literal dot — common in DNS-SD/mDNS service-instance names. A foo.bar
instance label in foo.bar._tcp.local decodes fine but re-serializes as two labels
(foo, bar), producing a malformed packet, even when the name wasn't modified.

Refernce

• RFC 1035 §3.1: a dot has no meaning inside a length-delimited label
• RFC 6763 §4.3: DNS-SD label boundaries must be preserved.

Fix

• Decode records the wire label boundaries as unexported metadata, allocated
  lazily — only when a label actually contains . or \ — so ordinary names add
  no allocations.
• Encode re-emits from those labels when the name is unchanged since decode (exact
  round-trip); otherwise it parses the name as presentation form where . separates
  labels, with \., \\, and \DDD escapes to embed literal bytes in a label.
• Name encoding now returns an error for invalid names (label > 63, name > 255, bad
  escape) instead of silently emitting a malformed packet.

This is a generic DNS fix, not mDNS-specific. It covers the DNS name fields gopacket
decodes: question/owner names and NS, CNAME, PTR, SOA, MX, and SRV RDATA. Non-name
RDATA (A/AAAA, TXT, URI, OPT) is unaffected.

Compatibility

Public API unchanged — same []byte fields, no new exported symbols. Decoded bytes and
ordinary names (example.com) serialize identically. The only behavior change: in a
constructed or modified name, \. now means a literal dot, which only affects
callers that opt into the escape syntax.

Testing

23 new tests (preservation across all covered fields, compression, decode→mutate→encode,
escapes, invalid-name errors, zero-copy buffer-reuse safety) plus a decode→serialize
fuzz target. go test ./layers, go vet, and gofmt clean.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.