caddyfile: support site-specific ECH configuration

[ousamabenyounes]

Summary

Adds support for configuring Encrypted Client Hello (ECH) inside a site's tls block:

example.com {
	tls {
		ech public.example.net {
			dns <provider>
		}
	}
}

Site-specific ECH configurations are aggregated into the global TLS app because ECH keys are managed at the app level, while
publication domains remain scoped to the relevant site.

This also:

• supports inheriting the global DNS provider;
• preserves global ECH publication behavior;
• deduplicates shared ECH public names;
• produces deterministic adapted JSON;
• adds automation policies for ECH public names.

Testing

The regression test fails on the unpatched master branch with:

unknown subdirective: ech

Validation performed:

• race-enabled tests pass;
• build passes;
• lint reports 0 issues;
• changed production lines have 100% test coverage (104/104).

Closes #6971.

AI assistance disclosure

OpenAI Codex assisted with the implementation, tests, and code review. I reviewed the contribution, understand the submitted
changes, and verified them with automated tests.

[CLAassistant]

All committers have signed the CLA.