Add OCSF DNS Activity normalization to coredns pipeline

Map CoreDNS query/response logs to OCSF DNS Activity [4003]. Adds OCSF
facets, a single-class sub-pipeline (no pre-transformation), and the
generated expected OCSF blocks in the test fixtures.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jbfeldman-dd