Add clusterRef to BindTSIGKey

TSIG keys were included in every cluster's keys.conf namespace-wide. When
multiple clusters share a namespace, that leaks keys across clusters. Add
spec.clusterRef so a key can target a specific BindCluster; empty keeps
the shared (all-clusters-in-namespace) behaviour.

- api: BindTSIGKey.spec.clusterRef (optional)
- BindCluster keys.conf now includes only keys with matching or empty
  clusterRef
- regenerate CRDs + install.yaml bundle

api/v1alpha1/bindtsigkey_types.go

@@ -16,6 +16,12 @@ const (
 // BindTSIGKeySpec defines a TSIG key. If no existing key material is imported,
 // the operator generates a random key and stores it in a Secret.
 type BindTSIGKeySpec struct {
+	// ClusterRef names the BindCluster this key is included in. When empty the
+	// key is shared with every cluster in the namespace (useful when multiple
+	// clusters share one namespace).
+	// +optional
+	ClusterRef string `json:"clusterRef,omitempty"`
+
 	// Algorithm is the HMAC algorithm. Defaults to hmac-sha256.
 	// +kubebuilder:default="hmac-sha256"
 	// +optional