upstream: fix connection pool leak

[fakhriaunur]

Summary

Fix CLOSE_WAIT connection leak in DNS-over-TLS connection pool.

The DoT connection pool stores connections in a slice and reuses them without validation. Over time, stale connections accumulate in CLOSE_WAIT state, leading to connection leaks and degraded performance (as noted in the TODO comment in dot.go:47-51).

Changes

• Add isConnAlive() helper function to validate connection health
• Modify getConn() to validate connections before reuse
• Close and discard dead/stale connections from the pool
• Add comprehensive table-driven tests:
  • "connection_closed_after_use"
  • "connection_pool_doesnt_leak_on_error"
  • "connection_pool_handles_timeout"
  • "concurrent_access_doesnt_cause_close_wait"
• Add TestIsConnAlive tests for connection validation

Root Cause

The TODO comment in dot.go:47-51 acknowledges this issue:

// TODO(e.burkov, ameshkov): Currently connections just stored in FILO
// order, which eventually makes most of them unusable due to timeouts.

Testing

# Run tests
go test -v -run TestDnsOverTLS_CloseWait ./upstream/
# Output: PASS (4 test cases, ~9s)

# Run race detection
go test -race ./upstream/
# Output: PASS (no races detected)

# Check coverage
go test -cover ./upstream/
# Coverage: 85.7% for conn(), 90.9% for isConnAlive()

# Run lint
go vet ./upstream/
# Output: PASS

Code Change Statistics

• Files modified: 2
• Lines changed: +343/-2
• Test coverage: 85.7% (conn), 90.9% (isConnAlive)

Technical Details

The fix uses a non-blocking read with a short deadline (10ms) to check connection health without affecting normal operation. Dead connections are closed and removed from the pool, preventing CLOSE_WAIT accumulation.

Issues

Fixes #444

Checklist

• Tests pass (go test ./upstream/)
• No race conditions (go test -race ./upstream/)
• Lint passes (go vet ./upstream/)
• Coverage ≥80% for modified functions
• Code change ≤15 lines in core logic
• References GitHub issue
• Addresses existing TODO comment

---

Note: This fix is minimal and targeted. It doesn't redesign the connection pool (which would be a larger change) but adds validation to prevent CLOSE_WAIT accumulation.