Deploy binddns-externaldns BIND cluster

Adds the external-dns tier (authoritative cluster whose zones accept RFC2136 TSIG updates) + its TSIG key. Stacked on the bind-operator deploy so the
CRDs and kubeconform schemas are present; merge the operator PR first.

- add apps/base/binddns-externaldns and its au-syd1 overlay

apps/base/binddns-externaldns/cluster.yaml

@@ -0,0 +1,26 @@
+---
+# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
+# authoritative cluster; external-dns writes to its zones via RFC2136 because
+# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: externaldns
+  namespace: binddns-externaldns
+spec:
+  mode: authoritative
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 1Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: dmz
+      external-dns.alpha.kubernetes.io/hostname: ns-ext.k8s.syd1.au.unkin.net
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi