fix(netxlite): reject replies with wrong queryID (#732)

This diff has been extracted from c2f7ccab0e

See https://github.com/ooni/probe/issues/2096

While there, export DecodeReply to decode a raw reply without
interpreting the Rcode or parsing the results, which seems a
nice extra feature to have to more flexibly parse DNS replies
in other parts of the codebase.

internal/netxlite/internal/generrno/main.go

@@ -159,6 +159,7 @@ var Specs = []*ErrorSpec{
 	NewLibraryError("DNS_server_misbehaving"),
 	NewLibraryError("DNS_no_answer"),
 	NewLibraryError("DNS_servfail_error"),
+	NewLibraryError("DNS_reply_with_wrong_query_ID"),
 	NewLibraryError("EOF_error"),
 	NewLibraryError("generic_timeout_error"),
 	NewLibraryError("QUIC_incompatible_version"),