Deploy binddns-externaldns BIND cluster

Adds the external-dns tier (authoritative cluster whose zones accept RFC2136 TSIG updates) + its TSIG key. Stacked on the bind-operator deploy so the
CRDs and kubeconform schemas are present; merge the operator PR first.

- add apps/base/binddns-externaldns and its au-syd1 overlay

apps/base/binddns-externaldns/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: binddns-externaldns