Restrict authoritative queries to internal networks

Mirrors the puppet authoritative master-zones view (match-clients
acl-main.unkin.net) using a global allow-query instead of a view, since
dynamic primary zones in a view would need per-view allow-new-zones.

- add auth-acl-main BindACL (the puppet acl-main.unkin.net networks)
- allow-query { auth-acl-main; 10.42.0.0/16; } on bind-authoritative
  (pod net included so secondaries can SOA-refresh from the primary)

apps/base/bind-internal/authoritative/cluster.yaml

@@ -11,6 +11,11 @@ spec:
   replicas: 3
   storageClassName: cephrbd-fast-delete
   storageSize: 2Gi
+  # Restrict queries to internal networks (puppet acl-main.unkin.net).
+  # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh
+  # from the primary during catalog replication.
+  extraOptions:
+    - "allow-query { auth-acl-main; 10.42.0.0/16; }"
   service:
     type: LoadBalancer
     annotations: