BindTSIGKey: add secretTemplate for labels/annotations on the managed Secret

The operator-generated TSIG Secret previously carried only the managed-by
label, so it could not be mirrored to another namespace by emberstack
reflector (which requires reflection-allowed annotations on the source).

Add spec.secretTemplate.{annotations,labels}, applied both when the Secret
is first generated and reconciled onto the existing Secret when the CR
changes (imported secrets are left untouched so we don't fight their
external manager). This lets the external-dns TSIG key be managed in
bind-internal and reflected into the externaldns namespace.

README.md

@@ -42,7 +42,7 @@ script picks one based on the pod ordinal.
 | `BindZone` | A forward/reverse zone (`primary`/`secondary`/`forward`/`stub`), records inline, optional dynamic-update + DNSSEC + catalog membership. |
 | `DNSRecord` | A single record set applied via TSIG `nsupdate` — external-dns as a CRD. |
 | `BindView` | A split-horizon view (`match-clients`, ordering, per-view recursion). |
-| `BindTSIGKey` | A TSIG key; the operator generates material into a Secret (never stored in the CR). |
+| `BindTSIGKey` | A TSIG key; the operator generates material into a Secret (never stored in the CR). `spec.secretTemplate` stamps extra labels/annotations onto that Secret (e.g. reflection hints to mirror it into another namespace). |
 | `BindACL` | A reusable named `address_match_list`. |
 | `BindCatalogZone` | A BIND catalog zone so secondaries auto-provision member zones. |
 | `BindPolicy` | A Response Policy Zone (RPZ) / DNS firewall. |