node:net: resolve server.listen() hosts through dns.lookup in every process - #47191

What does this PR do?

net.Server#listen(port, host) and tls.Server#listen(port, host) now resolve host the way Node does: dns.lookup(host, { all: true }), skip IPv6 link-local results, and bind the address that was picked (lookupAndListen, filterOnlyValidAddress).

Before, Bun did this lookup only in cluster workers (inside listenInCluster, gated on !isPrimary && !exclusive). Everywhere else the name went straight to the native listener, so:

const dns = require("node:dns"), net = require("node:net");
const lookup = dns.lookup;
dns.lookup = (h, o, cb) => (h === "my-alias.test" ? cb(null, [{ address: "127.0.0.1", family: 4 }]) : lookup(h, o, cb));
net.createServer().on("error", e => console.log("error:", e.message, e.code)).listen(0, "my-alias.test", function () {
  console.log("listening on", this.address().address);
  this.close();
});

node 26.12.1:   listening on 127.0.0.1
bun 1.4.4:      error: Failed to listen at my-alias.test undefined

and for a host that doesn't resolve, Node emits the dns.lookup error (getaddrinfo ENOTFOUND <host>, code: "ENOTFOUND", syscall: "getaddrinfo"), while Bun emitted Failed to listen at <host> with no code.

Changes in src/js/node/net.ts:

• lookupAndListen and filterOnlyValidAddress ported from Node. listen() calls lookupAndListen for a host name; the worker-only lookup in listenInCluster moves into it.
• The primary path binds the resolved address. hostname stays the name, because the TLS options (SNI serverName) are built from it in tls.ts.
• When the lookup answers, the TLS options are rebuilt so a setSecureContext() made meanwhile is used. The cluster-worker reply path already does this.
• A bind failure inside the lookup callback is emitted as 'error' on the next tick with formatListenError, the same as listen() does for a synchronous one.

Behaviour to be aware of:

• Deliberate divergence: IP literals are still bound directly. Node looks them up too, which only defers the bind, and it calls a patched dns.lookup with the IP. Keeping listen(port, "127.0.0.1") synchronous avoids changing the most common call. Happy to drop the shortcut if you'd rather match Node exactly.
• For a host name, address() is null and listening is false until the lookup answers, as in Node. Bun used to return them synchronously.
• Single address, no fallback: like Node, the server binds the one address the filter picks. The native listener used to try every resolved address in turn. "localhost" still binds ::1 on macOS (same as before and as Node). I haven't checked Linux.
• Overlap with Report an unresolvable listen hostname as a getaddrinfo error #37690: that PR fixes the same "Failed to listen at" symptom natively for Bun.listen / Bun.serve. With this change, net/tls servers report the dns.lookup error instead, whose name is DNSException in Bun (Error in Node). If both land, Report an unresolvable listen hostname as a getaddrinfo error #37690's node:net/node:tls expectations need the same name adjustment. The Bun.listen/Bun.serve part doesn't overlap.
• Not covered: http.Server#listen(port, host) doesn't go through net's listen (_http_server.ts), so it still ignores dns.lookup. Left for a follow-up.

How did you verify your code works?

• test/js/node/test/sequential/test-net-server-listen-ipv6-link-local.js: Node's test, byte-identical to v26.3.0. It passes on Node 26.12.1 and fails on Bun 1.4.4 ('Failed to listen at ipv6-link-local' !== 'Mocked error').
• test/js/node/net/server-listen-dns-lookup.test.js: 6 cases, written with node:test + node:assert so the same file runs under Node. Cases: mocked alias binds the resolved address and the lookup used all: true; a lookup error is emitted unchanged; a bind failure on the resolved address (TEST-NET-1 192.0.2.1) is an EADDRNOTAVAIL 'error' with syscall: "listen" and the resolved address; close() during the lookup cancels the bind with no event; tls.Server resolves the same way; setSecureContext() during the lookup is the context served. Hermetic: dns.lookup is mocked, nothing leaves the machine.

Platform notes: binding 192.0.2.1 should fail with EADDRNOTAVAIL on Linux and macOS, but would succeed on a host with net.ipv4.ip_nonlocal_bind=1. The vendored Node test skips itself without IPv6.