core: block CH queries earlier (#973)

block chaos queries, unless the chaos or proxy middleware is loaded. We
respond with REFUSED.

This removes the need for each middleware to do this class != ClassINET
if-then.

Also make config.Registry non-public.

core/dnsserver/config.go

@@ -42,7 +42,7 @@ type Config struct {
 	// Middleware interested in announcing that they exist, so other middleware can call methods
 	// on them should register themselves here. The name should be the name as return by the
 	// Handler's Name method.
-	Registry map[string]middleware.Handler
+	registry map[string]middleware.Handler
 }
 
 // GetConfig gets the Config that corresponds to c.