linux: explicitly drop all UDP egress except DNS in namespace filter

Author: ammario

src/jail/linux/nftables.rs

@@ -160,6 +160,9 @@ table ip {} {{
         udp dport 53 accept
         tcp dport 53 accept
 
+        # Explicitly block all other UDP (e.g., QUIC on 443)
+        udp drop
+
         # Allow traffic to the host proxy ports after DNAT
         ip daddr {} tcp dport {{ {}, {} }} accept
     }}