reject an apex NS DNSRecord instead of appending to the live RRset

BIND ignores an RRset-wide delete at a zone apex, so a DNSRecord for the
apex NS can only add to what the zone was seeded with while reporting
success. BindZone.spec.nameservers converges it per rdata.

config/crd/bases/bind.unkin.net_dnsrecords.yaml

@@ -86,6 +86,12 @@ spec:
             - values
             - zoneRef
             type: object
+            x-kubernetes-validations:
+            - message: 'an apex NS RRset cannot be managed by a DNSRecord: BIND ignores
+                an RRset-wide delete at a zone apex, so this would only append. Use
+                BindZone.spec.nameservers'
+              rule: '!(self.type.lowerAscii() == ''ns'' && (!has(self.name) || self.name
+                == ''@'' || self.name.size() == 0))'
           status:
             description: DNSRecordStatus reports observed record state.
             properties:

config/crd/install.yaml

@@ -3022,6 +3022,12 @@ spec:
             - values
             - zoneRef
             type: object
+            x-kubernetes-validations:
+            - message: 'an apex NS RRset cannot be managed by a DNSRecord: BIND ignores
+                an RRset-wide delete at a zone apex, so this would only append. Use
+                BindZone.spec.nameservers'
+              rule: '!(self.type.lowerAscii() == ''ns'' && (!has(self.name) || self.name
+                == ''@'' || self.name.size() == 0))'
           status:
             description: DNSRecordStatus reports observed record state.
             properties: