reject an apex NS DNSRecord instead of appending to the live RRset

BIND ignores an RRset-wide delete at a zone apex, so a DNSRecord for the
apex NS can only add to what the zone was seeded with while reporting
success. BindZone.spec.nameservers converges it per rdata.

api/v1alpha1/dnsrecord_types.go

@@ -6,6 +6,7 @@ import (
 
 // DNSRecordSpec defines a single record set applied to a zone via TSIG dynamic
 // update (nsupdate) — the external-dns write path expressed as a CRD.
+// +kubebuilder:validation:XValidation:rule="!(self.type.lowerAscii() == 'ns' && (!has(self.name) || self.name == '@' || self.name.size() == 0))",message="an apex NS RRset cannot be managed by a DNSRecord: BIND ignores an RRset-wide delete at a zone apex, so this would only append. Use BindZone.spec.nameservers"
 type DNSRecordSpec struct {
 	// ZoneRef names the BindZone this record belongs to. The cluster, view and
 	// update key are derived from the referenced zone.