Add k8s external-dns zones from puppet-prod

Migrates the two zones the puppet external-dns instances serve
(externaldns::k8s_zones) as dynamic BindZone CRs on the externaldns
cluster, plus a catalog zone so they replicate to the secondaries.

- add apps/base/ns-externaldns/zones.yaml: k8s.syd1.au.unkin.net and
  200.18.198.in-addr.arpa (primary, dynamicUpdate via externaldns-key)
- add a BindCatalogZone so external-dns writes to the primary replicate

apps/base/ns-externaldns/cluster.yaml

@@ -25,3 +25,15 @@ spec:
     limits:
       cpu: "1"
       memory: 512Mi
+---
+# Catalog zone so the dynamic zones replicate onto the cluster's secondaries
+# (external-dns writes to the primary; secondaries IXFR the result).
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCatalogZone
+metadata:
+  name: externaldns-catalog
+  namespace: ns-externaldns
+spec:
+  clusterRef: externaldns
+  zoneName: catalog.externaldns.internal
+  transferKeyRef: externaldns-key