fix(dns): enforce TLSA/CAA required fields for lower-case --type

[AshutoshMore142k4]

Summary

• --type is parsed with a value_parser that upper-cases the value, but clap matches required_if_eq against the raw argument (MatchedArg::check_explicit reads raw_vals_flatten()). So gddy dns add example.com --type tlsa … never triggered the --usage/--selector/--matching-type requirement that --type TLSA enforces — the record was built with certificateData but no usage/selector/matchingType and sent to the API, which the v3 schema requires all four for.
• --type caa slipped past the --tag requirement the same way. That one is caught by validate_caa_fields, but only in the handler — so for anyone not already authenticated it surfaces as an auth error rather than a validation error.
• Set ignore_case on the --type arg, which is what clap documents for exactly this case ("the equality check done by required_if_eq … is case-insensitive"). All four required_if_eq predicates in the crate key off this one argument, so a single flag covers both record types and keeps the rejection at parse time, before auth.
• Updated the two comments that claimed clap was already enforcing this, so the flag doesn't read as cosmetic and get dropped later.

Test plan

• cargo check --workspace
• cargo fmt --check
• cargo test --workspace — 776 passed
• ./rust/scripts/check-module-size.sh
• cargo clippy --workspace --all-targets -- -D warnings — clean for this change. (Heads-up unrelated to this PR: on a Windows host it errors on a pre-existing unused use super::* in extension/security/file_discovery.rs, whose only two tests are #[cfg(unix)], so the test module compiles empty there. CI on ubuntu is unaffected.)
• Added two rows to the existing invalid_dns_input_is_rejected_before_auth_or_dry_run table for lower-case tlsa and caa. Confirmed they fail without the fix — the tlsa row gets as far as auth resolution instead of being rejected at parse:
  expected "--usage", got: {"error": {"code": "ERROR", "message": "auth: no provider registered ...
• gddy dns add example.com --type tlsa --name www --data d2ab…e971 now fails at parse with the identical error --type TLSA gives (--usage <N>, --selector <N>, --matching-type <N>); mixed case TlSa too
• gddy dns set example.com --type caa --name @ --data letsencrypt.org now fails at parse asking for --tag
• No regressions: --type TLSA unchanged; lower-case tlsa with all three fields supplied parses and proceeds; --type a still works; --type bogus and --type ns still rejected with their existing messages

[Copilot]

🟢 Approval recommended

No unresolved blocking issues were identified.

Pull request overview

Fixes case-insensitive enforcement of required TLSA and CAA fields during DNS CLI parsing.

Changes:

• Enables case-insensitive --type requirements.
• Adds lowercase TLSA and CAA regression tests.
• Updates validation comments.

File summaries

File	Description
rust/src/dns/records.rs	Enables case-insensitive conditional requirements.
rust/src/dns/mod.rs	Adds lowercase TLSA and CAA validation tests.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.