net/dns/publicdns: Add Mullvad DoH

See https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/

The Mullvad DoH servers appear to only speak HTTP/2 and
the use of a non-nil DialContext in the http.Transport
means that ForceAttemptHTTP2 must be set to true to be
able to use them.

Signed-off-by: Nahum Shalman <nahamu@gmail.com>

net/dns/publicdns/publicdns.go

@@ -95,4 +95,14 @@ func populate() {
 	addDoH("149.112.112.10", "https://dns10.quad9.net/dns-query")
 	addDoH("2620:fe::10", "https://dns10.quad9.net/dns-query")
 	addDoH("2620:fe::fe:10", "https://dns10.quad9.net/dns-query")
+
+	// Mullvad
+	addDoH("194.242.2.2", "https://doh.mullvad.net/dns-query")
+	addDoH("193.19.108.2", "https://doh.mullvad.net/dns-query")
+	addDoH("2a07:e340::2", "https://doh.mullvad.net/dns-query")
+
+	// Mullvad -Ads
+	addDoH("194.242.2.3", "https://adblock.doh.mullvad.net/dns-query")
+	addDoH("193.19.108.3", "https://adblock.doh.mullvad.net/dns-query")
+	addDoH("2a07:e340::3", "https://adblock.doh.mullvad.net/dns-query")
 }

net/dns/resolver/forwarder.go

@@ -406,6 +406,7 @@ func (f *forwarder) getKnownDoHClientForProvider(urlBase string) (c *http.Client
 	})
 	c = &http.Client{
 		Transport: &http.Transport{
+			ForceAttemptHTTP2: true,
 			IdleConnTimeout: dohTransportTimeout,
 			DialContext: func(ctx context.Context, netw, addr string) (net.Conn, error) {
 				if !strings.HasPrefix(netw, "tcp") {