Deploy binddns-externaldns (RFC2136 dynamic cluster) (#222)

Part of the bind rollout split. **Merge #219 (bind-operator) first** — stacked on it; diff reduces to the binddns-externaldns files once #219 merges.

## Why
The external-dns tier (replaces 3x Puppet external-dns servers): an authoritative cluster whose zones accept RFC2136 TSIG updates from external-dns.

## Changes
- `apps/base/binddns-externaldns`: authoritative `BindCluster` (3 replicas, LoadBalancer/PureLB), `BindTSIGKey` for RFC2136, namespace
- au-syd1 `binddns-externaldns` overlay

## Deploy impact
Creates the `binddns-externaldns` StatefulSet + LoadBalancer once merged.

Reviewed-on: #222
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/base/ns-externaldns/zones.yaml

@@ -0,0 +1,34 @@
+# k8s external-dns zones migrated from puppet-prod
+# (externaldns::k8s_zones in hieradata/roles/infra/dns/externaldns.yaml).
+# Primary + dynamicUpdate: the Kubernetes external-dns controller writes
+# records here via RFC2136 authenticated with externaldns-key.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: k8s-syd1-au-unkin-net
+  namespace: ns-externaldns
+spec:
+  clusterRef: externaldns
+  zoneName: k8s.syd1.au.unkin.net
+  type: primary
+  defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: externaldns-key
+  allowTransfer:
+    - key externaldns-key
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 200-18-198-in-addr-arpa
+  namespace: ns-externaldns
+spec:
+  clusterRef: externaldns
+  zoneName: 200.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: externaldns-key
+  allowTransfer:
+    - key externaldns-key