Add primary (write) Services to the authoritative + externaldns clusters

Writes (RFC2136/nsupdate) must hit pod-0; the round-robin read Service
would land them on a secondary. Add a dedicated write endpoint per
cluster (operator v0.1.5 primaryService field).

- bind-authoritative: LoadBalancer write endpoint on 198.18.200.9
- bind-externaldns: ClusterIP write endpoint (in-cluster writers)
- regenerate bindcluster kubeconform schema (primaryService +
  externalTrafficPolicy)

external-dns is NOT yet repointed at bind-externaldns-primary: it
authenticates with the existing key, which the operator-generated key
doesn't match until the planned Vault-sync / secret-reflection features
land.

schemas/bind.unkin.net/bindcluster_v1alpha1.json

@@ -692,6 +692,35 @@
           },
           "type": "object"
         },
+        "primaryService": {
+          "properties": {
+            "annotations": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            "externalTrafficPolicy": {
+              "enum": [
+                "Cluster",
+                "Local"
+              ],
+              "type": "string"
+            },
+            "loadBalancerIP": {
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "ClusterIP",
+                "LoadBalancer",
+                "NodePort"
+              ],
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
         "recursion": {
           "type": "boolean"
         },
@@ -765,6 +794,13 @@
               },
               "type": "object"
             },
+            "externalTrafficPolicy": {
+              "enum": [
+                "Cluster",
+                "Local"
+              ],
+              "type": "string"
+            },
             "loadBalancerIP": {
               "type": "string"
             },