Clew v0.9.5

Changes

Destination excludes, DNS restore and SOCKS5 UDP fixes, most of them from the
first external contribution to Clew (thanks @FreemanZY).

• Destination exclude ranges now actually take effect. default_exclude_cidrs
  and a rule's dst_filter.exclude_cidrs were parsed from the config but never
  applied to forwarding, so traffic to private ranges was still going through
  the proxy. Both TCP and UDP honour them now.
• DNS restore no longer pins a DHCP interface to static servers. On a machine
  using DHCP, turning the DNS proxy off used to write the servers back as a
  static configuration, and the adapter stopped following DHCP from then on.
  Interfaces that were on automatic DNS are restored to automatic.
• SOCKS5 UDP works with a remote proxy. The UDP data socket was bound to
  loopback, so UDP could not reach a proxy running on another host.
• UDP replies from anything other than the SOCKS5 relay endpoint are dropped.

Internal: the per-port exclude policy snapshot was replaced with a single
immutable policy table published on config change. The old snapshot put an
owning pointer into a lock-free slot array, where a slot overwrite could free it
under a reader.

Full diff: v0.9.4...v0.9.5