Pin binddns-externaldns service to a dedicated IP

DNS (UDP/53) can't route via a shared gateway yet (no UDPRoute), so the
service needs its own LoadBalancer address instead of a pool-assigned one.

- pin purelb.io/addresses 198.18.200.8 (common pool); move service-group dmz -> common

apps/base/binddns-externaldns/cluster.yaml

@@ -15,7 +15,8 @@ spec:
   service:
     type: LoadBalancer
     annotations:
-      purelb.io/service-group: dmz
+      purelb.io/service-group: common
+      purelb.io/addresses: 198.18.200.8
       external-dns.alpha.kubernetes.io/hostname: ns-ext.k8s.syd1.au.unkin.net
   resources:
     requests: