Add functional review findings backlog

[fastbone]

Summary

• Adds REVIEW_FINDINGS.md, a fix-ready functional and bug-hunting audit backlog for FilterDNS.
• Fixes all 19 findings from the audit:
  • Critical SEV-01 through SEV-03: history RDATA/quarantine, IXFR diff identity, and CIDR matching.
  • High SEV-04 through SEV-09: DNS compression parsing, zone normalization, side-effect-free health checks, transfer refresh locking/no NOTIFY/stale-serial protection, IXFR snapshots/wraparound, and minimum-record-count pre-update checks.
  • Medium SEV-10 through SEV-17: CAA wire format, AXFR preflight sizing, NOTIFY validation, UDP overload response, verification retry/restart wiring, shared config validation, and non-mutating/atomic history saves.
  • Low SEV-18 through SEV-19: storage path/symlink hardening and regression test coverage.
• Re-ran a final review pass and addressed the follow-up issues it found:
  • poll/NOTIFY update path now uses stale/wraparound-aware serial checks;
  • symlinked ancestor directories are rejected;
  • stale REVIEW_FINDINGS.md wording is cleaned up;
  • obsolete private Program validator code is removed.

Validation

• git diff --check passes.
• dotnet test FilterDns.sln --no-restore passes 32/32 tests.
• dotnet build FilterDns.sln passes with 0 warnings/errors.
• cd FilterDns && dotnet run -- export example.com succeeds against the local BIND test master and outputs the filtered zone.