Add k8s external-dns zones from puppet-prod

Migrates the two zones the puppet external-dns instances serve
(externaldns::k8s_zones) as dynamic BindZone CRs on the externaldns
cluster, plus a catalog zone so they replicate to the secondaries.

- add apps/base/ns-externaldns/zones.yaml: k8s.syd1.au.unkin.net and
  200.18.198.in-addr.arpa (primary, dynamicUpdate via externaldns-key)
- add a BindCatalogZone so external-dns writes to the primary replicate

apps/base/ns-externaldns/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - namespace.yaml
   - tsigkey.yaml
   - cluster.yaml
+  - zones.yaml