Support externalTrafficPolicy on the client Service

Adds BindCluster.spec.service.externalTrafficPolicy so DNS LoadBalancers
can preserve client source IPs (Local), which the source-IP ACLs on the
authoritative/resolver need to actually restrict external clients (Cluster
SNATs everything to node IPs).

- api: ClusterServiceSpec.externalTrafficPolicy (enum Cluster;Local)
- set it on the client Service for LoadBalancer/NodePort types
- regenerate CRDs + install.yaml

config/crd/bases/bind.unkin.net_bindclusters.yaml

@@ -1094,6 +1094,15 @@ spec:
                     description: Annotations added to the client-facing Service (e.g.
                       PureLB/MetalLB hints).
                     type: object
+                  externalTrafficPolicy:
+                    description: |-
+                      ExternalTrafficPolicy for a LoadBalancer/NodePort Service. Local preserves
+                      client source IPs (required for source-IP ACLs on the DNS servers) but
+                      only routes to nodes running a pod. Defaults to Cluster.
+                    enum:
+                    - Cluster
+                    - Local
+                    type: string
                   loadBalancerIP:
                     description: LoadBalancerIP requests a specific address when Type
                       is LoadBalancer.

config/crd/install.yaml

@@ -1399,6 +1399,15 @@ spec:
                     description: Annotations added to the client-facing Service (e.g.
                       PureLB/MetalLB hints).
                     type: object
+                  externalTrafficPolicy:
+                    description: |-
+                      ExternalTrafficPolicy for a LoadBalancer/NodePort Service. Local preserves
+                      client source IPs (required for source-IP ACLs on the DNS servers) but
+                      only routes to nodes running a pod. Defaults to Cluster.
+                    enum:
+                    - Cluster
+                    - Local
+                    type: string
                   loadBalancerIP:
                     description: LoadBalancerIP requests a specific address when Type
                       is LoadBalancer.