[WIP] Add documentation for configuring Stubby with AdGuard DNS

[Copilot]

• Inspect the documentation structure, article conventions, and validation commands
• Add a new English Stubby article in the most appropriate docs section with correct front matter and links
• Update discoverability/order only if needed for the new article to appear in navigation
• Run targeted markdown/build validation for the affected docs
• Manually review the article for correctness, then scan changed files for secrets and run CodeQL

Original prompt

Add a new English documentation article to the AdguardTeam/KnowledgeBaseDNS repository explaining how to configure Stubby as a local DNS-over-TLS stub resolver using AdGuard DNS upstream servers.

Requirements:

• Add the article under the existing DNS client or another appropriate section for general Stubby/Linux documentation, following the repository's Docusaurus front matter, naming, sidebar, Markdown, and link conventions.
• Cover Stubby's role as a local stub resolver and explain that client applications should use the local listener while Stubby forwards queries to AdGuard DNS over TLS.
• Include installation instructions for common Linux distributions where practical, with a note to verify the package/configuration paths for the distribution.
• Provide a complete, valid Stubby YAML example using AdGuard DNS over TLS upstreams, including strict TLS authentication, appropriate tls_auth_name values, local listen addresses, and sensible resolver settings. Prefer hostnames for TLS authentication; if IP addresses are used, make the SNI/authentication name explicit. Do not invent certificate pin values.
• Explain how to configure multiple AdGuard upstreams for redundancy and how to choose the correct AdGuard DNS endpoint/variant (Default, Family, or Non-filtering). Link to the existing Known DNS Providers article where appropriate.
• Explain how to point the system resolver/applications to Stubby's local listener, including any relevant port-conflict caveat (for example, when another local resolver already owns port 53).
• Include service management commands (start, enable, restart/status) and practical verification/troubleshooting commands such as dig or nslookup, with expected checks for successful resolution and TLS connectivity where appropriate.
• Include a concise security/privacy note: DNS queries are encrypted between Stubby and the upstream resolver, but the selected upstream provider still receives the queries; strict certificate authentication should remain enabled.
• Avoid claiming that Stubby provides filtering itself; describe filtering as determined by the selected AdGuard DNS endpoint.
• Update the relevant section index/sidebar file if required so the article is discoverable. Do not modify generated translations or unrelated existing provider entries unless necessary.
• Match the tone and style of the existing English documentation and ensure commands and YAML are syntactically correct.