Allow EntryDnsServer to only listen on 127.0.0.1:53 as an option

[clandest]

Split from SC-882:

Modify EntryDnsServer so that it opens its listener on 127.0.0.1:53 instead of 0.0.0.0:53. This means that the EntryDnsServer will only be able to see requests that come from localhost, rather than requests that come over any network interface.

Possibly design this to be an option to operate in a more secure mode by not listening on non-loopback interfaces.