Add Quad9 secure DNS blocklist source

Detects domains blocked by Quad9's threat intelligence by comparing
the secure resolver (9.9.9.9) against the unsecured peer (9.9.9.10).
No API key required; enabled by default via the enable_quad9 user option.

checker/source_test.go

@@ -24,7 +24,7 @@ func TestRegisteredSourcesAreSane(t *testing.T) {
 		}
 	}
 	// At least the built-in sources are present.
-	for _, want := range []string{"dnsbl", "google_safe_browsing", "openphish", "pulsedive", "urlhaus", "virustotal"} {
+	for _, want := range []string{"dnsbl", "google_safe_browsing", "openphish", "pulsedive", "quad9", "urlhaus", "virustotal"} {
 		if !seen[want] {
 			t.Errorf("missing built-in source %q", want)
 		}