At guenther's suggestion replace dnssocket() with a SOCK_DNS flag on

At guenther's suggestion replace dnssocket() with a SOCK_DNS flag on
socket().  Without pledge, all other socket behaviours become permitted,
except this one case: connect/send* only works to *:53.  In pledge mode,
a very few are further restricted.  Some backwards compatibility for
the dnssocket/dnsconnect calls will remain in the tree temporarily so
that people can build through the transition.
ok tedu guenther semarie