fix(devcontainer): don't abort firewall setup when an optional domain fails to resolve

[ozdemirsarman]

Fixes #55623

The problem

init-firewall.sh runs under set -e and exits 1 as soon as any domain in the
allowlist fails to resolve. Since statsig.anthropic.com stopped resolving, that
single NXDOMAIN aborts the whole script: the ipset is left half-populated, the
default DROP policies are never applied, and the devcontainer fails to start with
exit code 1.

A telemetry or marketplace endpoint disappearing should not be able to break
container startup.

The fix

The domain list is split in two:

• Required (api.anthropic.com, registry.npmjs.org) — still fail loudly, the
  container is useless without them.
• Optional (telemetry, VS Code marketplace) — skipped with a warning and
  summarized at the end, so the reason for a later connection failure stays visible
  rather than being silently swallowed.

Invalid (non-IPv4) DNS answers get the same treatment: hard error for required
domains, skip with a warning otherwise.

Testing

Verified with a stubbed dig/ipset:

# statsig.anthropic.com unresolvable
before: ERROR: Failed to resolve statsig.anthropic.com          exit 1
after:  WARNING: Failed to resolve statsig.anthropic.com - skipping (not required)
        NOTE: 1 optional domain(s) could not be resolved and were not allowlisted:
          - statsig.anthropic.com
        (remaining domains still added)                          exit 0

# api.anthropic.com unresolvable (required)
after:  ERROR: Failed to resolve required domain api.anthropic.com   exit 1

# all domains resolvable
after:  unchanged behaviour                                      exit 0

bash -n and shellcheck clean.