Sockets: running actors get TCP, UDP, and DNS through wasi:sockets; candidates get no network

PROTOCOL.md

@@ -16,7 +16,9 @@ The instance gets:
 - **stderr:** free text, appended to `/actor/<id>/stderr.log`
 - **environment:** `SAUSAGE_ACTOR` (its ID), `SAUSAGE_VERSION` (its version),
   and `SAUSAGE_CANDIDATE=1` during a test run
-- **outgoing HTTP and HTTPS** through `wasi:http` (no raw sockets)
+- **the network:** outgoing HTTP and HTTPS through `wasi:http` (the host does
+  TLS), and TCP, UDP, and DNS through `wasi:sockets`, including listening on
+  a port of the host
 - **the filesystem** described below
 
 ## Messages
@@ -105,7 +107,7 @@ with the reason. All versions share the actor's `data/` and `public/`: a
 new version must read the data of the old one.
 
 **Tests.** The broker runs the candidate on a copy of the actor's `data/`
-and `public/`, without HTTP. The tests are JSON files in
+and `public/`, without network. The tests are JSON files in
 `<source>/tests/*.json`, one scenario per file:
 
 ```json