Add DNS-aware whitelisting feature

Support for whitelisting SIP trunks and providers by hostname or SRV
record with automatic IP resolution and periodic refresh.

Features:
- Hostname resolution via A/AAAA records
- SRV record resolution (e.g., _sip._udp.provider.com)
- Configurable refresh interval (default 5m)
- Stale entry handling when DNS fails
- Admin API endpoints for DNS whitelist management
- Caddyfile directives: whitelist_hosts, whitelist_srv, dns_refresh

This allows whitelisting by provider name rather than tracking
constantly-changing IP addresses.

l4handler.go

@@ -322,6 +322,7 @@ func (h *SIPHandler) Handle(cx *layer4.Connection, next layer4.Handler) error {
 }
 
 // suspiciousPatternDefs defines patterns and their names for detection
+// IMPORTANT: Patterns must be specific enough to avoid false positives on legitimate traffic
 var suspiciousPatternDefs = []struct {
 	name    string
 	pattern string
@@ -331,12 +332,14 @@ var suspiciousPatternDefs = []struct {
 	{"sipcli", "sipcli"},
 	{"sip-scan", "sip-scan"},
 	{"voipbuster", "voipbuster"},
-	{"asterisk-pbx-scanner", "asterisk pbx"},
+	// Note: "asterisk pbx scanner" pattern removed - too broad, catches legitimate Asterisk PBX systems
+	// The original pattern "asterisk pbx" would match "User-Agent: Asterisk PBX 18.0" which is legitimate
 	{"sipsak", "sipsak"},
 	{"sundayddr", "sundayddr"},
 	{"iwar", "iwar"},
-	{"cseq-flood", "cseq: 1 options"}, // Repeated OPTIONS flood
-	{"zoiper-spoof", "user-agent: zoiper"},
+	// Note: "cseq: 1 options" pattern REMOVED - too broad, catches ANY first OPTIONS request
+	// OPTIONS with CSeq 1 is completely normal - it's the first OPTIONS from any client
+	// Use rate limiting for OPTIONS flood detection instead
 	{"test-extension-100", "sip:100@"},
 	{"test-extension-1000", "sip:1000@"},
 	{"null-user", "sip:@"},