Split address and qname filtering into separate functions,
process the first bytes of the qname in the first function
to keep the second one under 4096 instructions.
The `imm` field of `struct bpf_insn` is signed, fix the cast.
Wrap FDs so they are released when we throw an exception in the ctor.