Target upstream ISC bind9 image

Uses internetsystemsconsortium/bind9 as the default base image instead of
a self-hosted one, verified against internetsystemsconsortium/bind9:9.20
(runs as root; named/rndc/nsupdate at /usr/sbin,/usr/sbin,/usr/bin).

- project operator config at /etc/bind-operator instead of overmounting
  the image's /etc/bind (keeps bind.keys / base config intact)
- reference named/rndc/nsupdate by absolute path (exec PATH may exclude
  /usr/sbin)
- centralise filesystem + binary paths in internal/bind/consts.go
- default spec.image to internetsystemsconsortium/bind9:9.20

internal/bind/nsupdate.go

@@ -41,7 +41,7 @@ func (e *Executor) NSUpdate(ctx context.Context, namespace, pod, zone string, cr
 	}
 	b.WriteString("send\n")
 
-	cmd := []string{"nsupdate", "-y", fmt.Sprintf("%s:%s:%s", creds.Algorithm, creds.Name, creds.Secret)}
+	cmd := []string{NsupdateBin, "-y", fmt.Sprintf("%s:%s:%s", creds.Algorithm, creds.Name, creds.Secret)}
 	if out, err := e.Exec(ctx, namespace, pod, cmd, b.String()); err != nil {
 		return fmt.Errorf("nsupdate zone %s: %w (out: %s)", zone, err, out)
 	}