feat: Add subdomain matching for forced hosts

[alchemyyy]

Adds an option for subdomain-matching to [forced-hosts] that falls back to suffix matching on domain boundaries when no exact match is found. This allows forced hosts to work when DNS services (e.g., Cloudflare proxied SRV records) prepend prefixes to the virtual hostname.

The problem is that Velocity does exact string matching on the virtual host for forced-hosts, so _dc-srv.xxxxx.play.example.com doesn't match play.example.com and forced host routing breaks.

This is a "rework" of this rejected PR: #1497

I'd like to clear up that the use-case for this feature isn't "hiding a misconfiguration". When you proxy an SRV target's A record through Cloudflare, Cloudflare auto-unproxies it by rewriting the hostname to something like _dc-srv.xxxxx.play.example.com. This was intentional on my part since it causes casual DNS lookups on play.example.com return Cloudflare IPs, and the origin is only exposed if someone specifically queries the Minecraft SRV record and follows the chain. This gives you two things; A free bit of hardening against pretty much any normal scraper, and the ability to run a server with the DNS as a Cloudflare proxied site (or other HTTP/s endpoint).

This implementation addresses the following shortcomings with the old PR:

• Vhost is correct. When a subdomain match fires, the virtual host gets rewritten to the configured hostname before it's stored on the connection. getVirtualHost() returns play.example.com, not the mangled hostname. Plugins, MOTD, analytics — everything sees the right value.
• Not provider-specific. When subdomain-matching = true is set under [forced-hosts], Velocity checks if the incoming hostname ends with any configured forced host on a dot boundary. Works for any DNS service that prepends to hostnames.
• Dot boundary enforced. notplay.example.com does not match play.example.com. Only actual subdomains match.
• Opt-in, default off. Existing behavior is untouched unless you explicitly enable it.
• Debug logging. Subdomain matches and misses are logged at DEBUG level so operators can see exactly what hostname Velocity received and what it matched against.