Fix: Unsynchronized staging matcher access races during reload

=== Classification
- Type: race condition
- Severity: high
- Confidence: certain

=== Affected Locations
- `dnscrypt-proxy/plugin_cloak.go:167`
- `dnscrypt-proxy/plugin_cloak.go:191`
- `dnscrypt-proxy/plugin_cloak.go:198`

=== Summary
`PluginCloak.stagingMatcher` was accessed from reload paths without consistent locking. `PrepareReload()` created and populated a staged matcher without holding the mutex, `ApplyReload()` consumed it under lock, and `CancelReload()` cleared it without lock. Concurrent reload, apply, or cancel operations on the same instance could therefore race and corrupt the staged-to-active handoff.

=== Provenance
The finding was reproduced from a verified report derived from Swival Security Scanner (https://swival.dev) output and confirmed locally with the Go race detector.

=== Preconditions
- Concurrent reload operations on one `PluginCloak` instance

=== Proof
- `PrepareReload()` assigned `plugin.stagingMatcher = NewPatternMatcher()` and filled it without synchronization in `dnscrypt-proxy/plugin_cloak.go:167`.
- `ApplyReload()` read and swapped `stagingMatcher` while holding `plugin.Lock()` in `dnscrypt-proxy/plugin_cloak.go:191`.
- `CancelReload()` wrote `plugin.stagingMatcher = nil` without locking in `dnscrypt-proxy/plugin_cloak.go:198`.
- A temporary reproducer concurrently invoked `plugin.Reload()` on one `PluginCloak`.
- Running `go test -race ./dnscrypt-proxy -run TestPluginCloakConcurrentReloadRace -count=1` reported:
  - write/write race in `PrepareReload()`
  - read/write race involving `ApplyReload()` and staged field clearing
- Observed impact matched the report: one goroutine could apply another goroutine's staged matcher or see `nil`, causing lost updates or spurious `no staged configuration to apply` failures.

=== Why This Is A Real Bug
This is not a theoretical race. The field participates directly in configuration state transfer between reload phases, and the race detector reported conflicting accesses under a realistic concurrent reload scenario. Because the staged matcher can be overwritten or cleared mid-handoff, reload behavior becomes non-atomic and can apply the wrong configuration or fail unexpectedly.

=== Fix Requirement
Guard all reads and writes of `stagingMatcher` with the same mutex.

=== Patch Rationale
The patch serializes every `stagingMatcher` access through `PluginCloak`'s mutex so staging, apply, and cancel all observe a consistent reload state. This preserves the intended staged-to-active handoff and removes the conflicting unsynchronized accesses identified by the reproducer.

=== Residual Risk
None

=== Patch
- Patched in `006-unsynchronized-staging-matcher-access-races-during-reload.patch`
- The patch wraps `stagingMatcher` mutation and consumption in `dnscrypt-proxy/plugin_cloak.go` with the existing mutex, aligning `PrepareReload()`, `ApplyReload()`, and `CancelReload()` on one synchronization mechanism.

Author: jedisct1

dnscrypt-proxy/plugin_cloak.go

@@ -175,36 +175,41 @@ func (plugin *PluginCloak) PrepareReload() error {
 		return fmt.Errorf("error reading config file during reload preparation: %w", err)
 	}
 
-	// Create new staging pattern matcher
-	plugin.stagingMatcher = NewPatternMatcher()
+	stagingMatcher := NewPatternMatcher()
 
 	// Load rules into staging matcher
-	if err := plugin.loadRules(lines, plugin.stagingMatcher); err != nil {
+	if err := plugin.loadRules(lines, stagingMatcher); err != nil {
 		return fmt.Errorf("error parsing config during reload preparation: %w", err)
 	}
 
+	plugin.Lock()
+	plugin.stagingMatcher = stagingMatcher
+	plugin.Unlock()
+
 	return nil
 }
 
 // ApplyReload atomically replaces the active pattern matcher with the staging one
 func (plugin *PluginCloak) ApplyReload() error {
+	plugin.Lock()
+	defer plugin.Unlock()
+
 	if plugin.stagingMatcher == nil {
 		return errors.New("no staged configuration to apply")
 	}
 
-	// Use write lock to swap pattern matchers
-	plugin.Lock()
 	plugin.patternMatcher = plugin.stagingMatcher
 	plugin.stagingMatcher = nil
-	plugin.Unlock()
 
 	dlog.Noticef("Applied new configuration for plugin [%s]", plugin.Name())
 	return nil
 }
 
 // CancelReload cleans up any staging resources
 func (plugin *PluginCloak) CancelReload() {
+	plugin.Lock()
 	plugin.stagingMatcher = nil
+	plugin.Unlock()
 }
 
 // Reload implements hot-reloading for the plugin