v3.17.0

## Features

- Upgrade Alpine from 3.12 to 3.13
- Upgrade `openvpn` from 2.4.10 to 2.5.1
- Upgrade `unbound` from 1.10.1 to 1.13.0
- Upgrade `iptables` from 1.8.4 to 1.8.6
- Protonvpn support (#437 clone on #434)
- Restart Openvpn if the container is unhealthy (#417 & #441)
- Block IPv6 traffic (#428)
    - Block all IPv6 traffic with `ip6tables` by default
    - Adapt existing firewall code to handle IPv4 and IPv6, depending on user inputs and environment
    - Only run `ip6tables` if it is supported by the Kernel (#431, issue #430)
- Update server information
    - Cyberghost
    - FastestVPN
    - HideMyAss
    - Privado
    - PrivateVPN
    - Private Internet Access
    - PureVPN
    - Surfshark
    - VyprVPN
- Clear firewall rules on shutdown (issue #276)
Feature: more robust updater DNS resolution
  - Parallel resolver to resolve multiple hosts
  - Repeat resolver to repeat resolution for a single host
  - Additional parameters for fault toleration
  - Do not update servers if 10% of DNS resolutions failed
  - `resolver` package in `internal/updater` package

## Fixes

- Replace Surfshark default cipher with `aes-256-gcm`
- Block IPv6 traffic (#428)
- Remove `pull-filter ignore ping-restart` openvpn instructions

## Maintenance

- Upgrade `golangci-lint` to `v1.39.0`
- Improve error wrapping in the `firewall` package
- Dev container changes
  - Bind mount for root only
  - Support for Windows HyperV bind mounts
  - Run `go mod tidy` after `go mod download` on container creation
  - Use `:z` flag for possibly shared bind mounts
  - Bind mount `~/.zsh_history`
  - Bind mount `~/.docker` config directory