Deploy bind-operator (operator + CRDs)

Deploys the bind-operator control plane on its own so it can be verified
before any DNS clusters are created. The three BIND tiers follow as
separate PRs.

- add apps/base/bind-system: operator Deployment (image v0.1.1), RBAC,
  namespace, and CRDs pulled from the operator repo by raw URL
- add au-syd1 bind-system overlay
- register all four bind apps in the platform ApplicationSet (the DNS
  overlays are instantiated only once their dirs land in later PRs)
- add binddns-* namespaces to the platform AppProject destinations
- add schemas/bind.unkin.net/*.json so kubeconform validates the CRs

apps/base/bind-system/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  # CRDs are pulled from the bind-operator repo at the matching tag rather than
+  # vendored here, so they never drift from the operator.
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.1/config/crd/install.yaml
+  - rbac.yaml
+  - deployment.yaml