fix: replace Mutex<DnsState> with OnceCell in NonLocalDnsResolver

[Rohan-Singla]

Motivation

NonLocalDnsResolver used Arc<Mutex<DnsState>> for lazy initialization of the DNS resolver. During the Init state, the mutex lock was held across an .await boundary specifically across the new_resolver().await call which performs I/O (reads system DNS config and builds the resolver).

This meant that under concurrent webhook dispatch, all DNS calls arriving before initialization completed would block waiting to acquire the mutex, serializing them behind a single I/O operation. On a high-throughput instance processing thousands of webhooks per second, this is a contention point at startup.

Solution

Replaced Arc<Mutex<DnsState>> with Arc<tokio::sync::OnceCell<TokioResolver>>. The get_or_try_init method handles the lazy initialization correctly only one caller runs the initializer, concurrent callers wait on a lightweight internal notifier (not a mutex), and all subsequent calls after initialization is complete are lock-free atomic loads.

The DnsState enum and the Arc wrapper around TokioResolver are both removed as they are no longer needed. new_resolver() now returns TokioResolver directly. No behavior change the DNS resolution logic and IP filtering are untouched.

tokio::sync::OnceCell requires no new dependency as tokio is already pulled in with features = ["full"].

[svix-jplatte]

Thanks for the PR! I'm wondering why we ever made new_resolver async given that it does no async I/O. Would you mind also changing that function to do all its actual work in a blocking tokio task?

[svix-jplatte]

Nice! I hadn't encountered this pattern before, but it seems more sensible than a plain unwrap.

[Rohan-Singla]

Ahan cool!

[svix-jplatte]

Thanks again!

[Rohan-Singla]

Thanks again!

Welcome looking forward to contribute more!