• Stacked on top of libnet/d/bridge: Don't set container's gateway when network is internal #46603
• Related to CI failures seen on integration: Add a new networking integration test suite  #46531

- What I did

First commit adds a way to enable/disable upstream forwarding to the embedded resolver. When an endpoint joins/leaves a sandbox, this forwarding policy is modified based on whether there's an endpoint providing external connectivity.

Second commit ensures the resolver return a REFUSED response with the RA bit (ie. Recursion Available) unset when upstream forwarding is disabled and no matching container/alias can be found.

- Description for the changelog

• The embedded DNS resolver now returns a REFUSED response when upstream forwarding is disabled (ie. on internal networks, or on Windows) and no container/alias match the queried name.

- A picture of a cute animal (not mandatory but encouraged)