Target upstream ISC bind9 image

Uses internetsystemsconsortium/bind9 as the default base image instead of
a self-hosted one, verified against internetsystemsconsortium/bind9:9.20
(runs as root; named/rndc/nsupdate at /usr/sbin,/usr/sbin,/usr/bin).

- project operator config at /etc/bind-operator instead of overmounting
  the image's /etc/bind (keeps bind.keys / base config intact)
- reference named/rndc/nsupdate by absolute path (exec PATH may exclude
  /usr/sbin)
- centralise filesystem + binary paths in internal/bind/consts.go
- default spec.image to internetsystemsconsortium/bind9:9.20

internal/controller/helpers.go

@@ -23,6 +23,9 @@ const (
 	clusterLabel   = "bind.unkin.net/cluster"
 
 	finalizer = "bind.unkin.net/finalizer"
+
+	// defaultBindImage is used when BindCluster.spec.image is empty.
+	defaultBindImage = "internetsystemsconsortium/bind9:9.20"
 )
 
 func headlessServiceName(cluster string) string { return cluster + "-headless" }