Make external-dns tier authoritative (drop dynamic mode)

The dynamic cluster mode was removed from the operator; RFC2136 update
capability is a per-zone property, not a cluster role. The external-dns
tier is an authoritative cluster whose zones set dynamicUpdate.

- switch binddns-externaldns BindCluster to mode authoritative
- regenerate bindcluster schema (enum: authoritative, resolver)

apps/base/binddns-externaldns/cluster.yaml

@@ -1,13 +1,14 @@
 ---
-# external-dns tier (replaces the 3x Puppet external-dns servers). The primary
-# accepts RFC2136 TSIG updates from external-dns; secondaries replicate.
+# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
+# authoritative cluster; external-dns writes to its zones via RFC2136 because
+# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindCluster
 metadata:
   name: externaldns
   namespace: binddns-externaldns
 spec:
-  mode: dynamic
+  mode: authoritative
   replicas: 3
   storageClassName: cephrbd-fast-delete
   storageSize: 1Gi

schemas/bind.unkin.net/bindcluster_v1alpha1.json

@@ -682,8 +682,7 @@
           "default": "authoritative",
           "enum": [
             "authoritative",
-            "resolver",
-            "dynamic"
+            "resolver"
           ],
           "type": "string"
         },