Deploy bind-operator (operator + CRDs)

Deploys the bind-operator control plane on its own so it can be verified
before any DNS clusters are created. The three BIND tiers follow as
separate PRs.

- add apps/base/bind-system: operator Deployment (image v0.1.1), RBAC,
  namespace, and CRDs pulled from the operator repo by raw URL
- add au-syd1 bind-system overlay
- register all four bind apps in the platform ApplicationSet (the DNS
  overlays are instantiated only once their dirs land in later PRs)
- add binddns-* namespaces to the platform AppProject destinations
- add schemas/bind.unkin.net/*.json so kubeconform validates the CRs

argocd/projects/platform.yaml

@@ -21,6 +21,12 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'authentik'
       server: https://kubernetes.default.svc
+    - namespace: 'binddns-auth'
+      server: https://kubernetes.default.svc
+    - namespace: 'binddns-resolver'
+      server: https://kubernetes.default.svc
+    - namespace: 'binddns-externaldns'
+      server: https://kubernetes.default.svc
     - namespace: 'cert-manager'
       server: https://kubernetes.default.svc
     - namespace: 'certificates'