Add authoritative zones from puppet-prod master nameservers

Migrates the 18 zones served by the puppet authoritative masters
(profiles::dns::master::zones) as BindZone CRs on the auth cluster:
unkin.net, main.unkin.net, and the 198.18.{13-29}.0/24 reverse zones.

- add apps/base/ns-auth/zones.yaml (type primary, TTL 600); records are
  migrated separately (not stored in puppet, generated via PuppetDB)

apps/base/ns-auth/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - namespace.yaml
   - tsigkey.yaml
   - cluster.yaml
+  - zones.yaml