DNS selector and secure default (DNSSEC, DoT, ECH supported)

[RoyalOughtness]

We will repurpose the first run view to display a "choose your DNS provider" dropdown. This dropdown will have selected by default a DNS provider that supports every security mechanism a DNS provider can (DNSSEC, DoT, ECH). It will make clear in the list of providers which ones support which mechanisms. It will also leave "OS provided DNS" as an option. This forces the user to acknowledge the behavior at first run and override it if they choose, so users aren't blindsided by their browser DNS suddenly changing