mail-relay: Verify outbound sender MX

Nothing prevents a backend from requesting a shared mail relay for an existing well-known domain that they do not own, and that may already be used as a mail domain by the rightful owners. That's ok as long as such a domain is not allowed to send outbound mail through the relay.

To prevent this, outbound sender domains are allowed only if either:

• they are explicitly whitelisted in the cluster configuration by being listed in the allowed domains for an external proxy.
• they have no MX record resolving to an IP nor A/AAAA record, meaning there is no public way to send mail to this domain.
• they have MX records pointing exclusively - but not necessarily exhaustively - to the FQDNs of the relays in the cluster.

This is easier and more flexible than requiring backends to prove they own their domain, e.g. with a form of DNS challenge. It allows the use of non-existing domains for sending internally from backend to backend.