basic_firewall 1.0.0-beta16

Brings the module up to kanopi/firewall 2.38.0. The one change is a time limit on crawler verification: a site can now send the DNS lookups behind it to a DNS-over-HTTPS provider instead of PHP. Nothing changes until a site chooses one.

## Before you upgrade

- **No new floor.** The module still requires `kanopi/firewall` ^2.37. The new settings appear only with 2.38.0 or later, so run `composer update kanopi/firewall` to get them. On 2.37 this release behaves exactly like beta15.
- **Nothing to run.** There are no database updates and no settings to re-save.

## Crawler verification can have a time limit (#103)

A user agent rule that verifies the crawler (Googlebot, Bingbot and so on) checks the visitor's address with two DNS lookups. PHP makes those lookups and can't put a timeout on them. On a host without a local caching resolver, one slow nameserver could hold a PHP worker for up to ten seconds.

The **General** tab has a new **Crawler verification lookups** section:

- **PHP's own lookups** are the default. They behave exactly as before, and nothing is sent to a third party.
- **Cloudflare** or **Google** DNS over HTTPS makes the lookups instead, and each one is cut off at a time limit, 300 ms by default. kanopi/firewall measured this with a provider that never answers: the first worker gave up after about 307 ms, and the rest were refused in under a millisecond.

**Choosing a provider sends it data.** The provider receives the reverse-DNS names of visitors' addresses, for requests that claim to be a crawler one of your rules verifies. The section links the library's [Reverse DNS](https://kanopi.github.io/firewall/2.38/configuration/reverse-dns/) page, which says who runs each provider, what it receives and what it logs. Read it before choosing. The form refuses a provider if the server doesn't have PHP's curl extension.

A **user agent rule** can choose its own provider and time limit in its verification section. Both default to the site's choice. If you run your own DNS-over-HTTPS server, or have your own resolver class, add it in **Additional YAML** under `global.reverse_dns`. The README covers both.

Verification still only runs when `$settings['basic_firewall_sources_offline'] = FALSE;` is set in `settings.php`, as before.

## Compatibility

- **Floor unchanged:** `kanopi/firewall` ^2.37. The new section and fields appear on 2.38.0 or later.
- **No behavior changes** unless a provider is chosen. A site that changes nothing compiles the same firewall configuration as before.
- **2.38's list-merging changes don't affect this module.** In kanopi/firewall 2.38, a list set in a later config now replaces the earlier one instead of being added to it. That matters only to code that hands the library more than one config. The module hands it a single compiled file, and its presets only add rules, which are still added. So nothing the module enforces changes.