docs(cloudflare-one): document DNS resolution location for host egress selectors (#31927)

Adds a Known issues note to the host-selectors page explaining that the
destination IP for Application/Content Categories/Domain/Host egress
selectors is captured at Gateway DNS resolution time and is not changed
by the egress policy, so destination selection is decoupled from egress
location. This can cause failures against destinations that enforce
geo-restriction or IP-allowlisting when the resolved destination IP and
egress IP are in different regions.

Cross-referenced from the egress-policies parent page under Selector
prerequisites.

Ref: DEE-3675 / SFDC 02218769

Author: stechedo

src/content/docs/cloudflare-one/traffic-policies/egress-policies/host-selectors.mdx

@@ -108,6 +108,14 @@ The Cloudflare One Client must be set to _Traffic and DNS mode_ for traffic affe
 
 ## Known issues
 
+### DNS resolution location
+
+For the [Application](/cloudflare-one/traffic-policies/egress-policies/#application), [Content Categories](/cloudflare-one/traffic-policies/egress-policies/#content-categories), [Domain](/cloudflare-one/traffic-policies/egress-policies/#domain), and [Host](/cloudflare-one/traffic-policies/egress-policies/#host) selectors, Gateway captures the destination IP address during the initial DNS resolution step described above. The egress policy does not change this IP address, so the destination Gateway connects to is independent of the location of the egress data center or dedicated egress IP you select.
+
+If the resolved destination IP and the egress IP are located in different regions, connections to destinations that enforce geo-restriction or IP-allowlisting based on the connection source may be rejected.
+
+This can affect you if you use Domain or Host egress selectors, your users are located outside the region associated with your egress IP, and the destination applies geo-restriction or IP-based access controls.
+
 ### Google Chrome restricts local network access
 
 <Render file="gateway/egress-selector-chrome-issue" product="cloudflare-one" />

src/content/docs/cloudflare-one/traffic-policies/egress-policies/index.mdx

@@ -250,3 +250,5 @@ Gateway uses Rust to evaluate regular expressions. The Rust implementation is sl
 ### Selector prerequisites
 
 The [Application](#application), [Content Categories](#content-categories), [Domain](#domain), and [Host](#host) selectors require additional setup before they work in egress policies. Before deploying policies with these selectors, refer to [Host selectors](/cloudflare-one/traffic-policies/egress-policies/host-selectors).
+
+These selectors also resolve the destination IP address when Gateway processes the DNS query, not when the egress policy is applied. If the resolved destination IP and your egress IP are in different regions, connections to destinations that enforce geo-restriction or IP-allowlisting may fail. Refer to [DNS resolution location](/cloudflare-one/traffic-policies/egress-policies/host-selectors/#dns-resolution-location) for details.