Merge "Ensure apps can't directly access the dnsresolver service." into main