Target upstream ISC bind9 image

Uses internetsystemsconsortium/bind9 as the default base image instead of
a self-hosted one, verified against internetsystemsconsortium/bind9:9.20
(runs as root; named/rndc/nsupdate at /usr/sbin,/usr/sbin,/usr/bin).

- project operator config at /etc/bind-operator instead of overmounting
  the image's /etc/bind (keeps bind.keys / base config intact)
- reference named/rndc/nsupdate by absolute path (exec PATH may exclude
  /usr/sbin)
- centralise filesystem + binary paths in internal/bind/consts.go
- default spec.image to internetsystemsconsortium/bind9:9.20

README.md

@@ -90,8 +90,10 @@ on pull requests; pushing a `v*` tag builds and pushes
 ## Notes & caveats
 
 - The BIND container image (`spec.image`, default
-  `git.unkin.net/unkin/bind9:latest`) must ship `named`, `rndc` and `nsupdate`,
-  read `/run/named/named.conf`, and honour the operator's `/etc/bind` layout.
+  `internetsystemsconsortium/bind9:9.20`) must ship `named`, `rndc` and
+  `nsupdate`. The operator projects its config at `/etc/bind-operator` (leaving
+  the image's own `/etc/bind`, including `bind.keys`, intact) and runs
+  `named -g -c /run/named/named.conf`.
 - Dynamic updates authenticate with `nsupdate -y`; the TSIG secret is passed on
   the argv of an exec'd process inside the pod.
 - RPZ IP-trigger encodings (`ip`, `client-ip`, `nsip`) are emitted verbatim;