support DNS over TLS for upstream name lookups

[willie]

While the underlying Go network stack supports DNS lookups over TLS, Docker provides no way to specify that the DNS server passed with --dns is capable of DNS over TLS (or if it is desired).

Example code here: https://github.com/artyom/dot/blob/master/dot.go#L44

Sadly, I do not understand the libnetwork codebase well enough to submit a PR.