v0.2.1 fixes authoritative secondary replication, which never worked:
the master REFUSED the catalog AXFR because secondaries presented no TSIG
key, member zones had no allow-transfer, and secondaries chased the
primary's ephemeral pod IP.
- Bump the operator image and the pulled CRD bundle to v0.2.1.
- Bump the bind-tsig-api image to v0.2.1.
CRDs are unchanged from v0.2.0, so the generated schemas need no update.