Drop redundant dynamic cluster mode

The dynamic mode produced a byte-identical cluster to authoritative:
RFC2136 update capability is a per-zone property (BindZone.dynamicUpdate
+ updateKeyRef render allow-update { key ... }), not a cluster role. The
external-dns tier is just an authoritative cluster whose zones allow
dynamic updates.

- remove BindMode dynamic from the enum and constants
- switch the external-dns sample to mode authoritative
- update README migration mapping

config/samples/03-external-dns.yaml

@@ -1,13 +1,14 @@
 ---
-# external-dns role (replaces 3x Puppet external-dns servers). The primary
-# accepts RFC2136 TSIG updates from external-dns; secondaries replicate.
+# external-dns role (replaces 3x Puppet external-dns servers). This is an
+# ordinary authoritative cluster; external-dns writes to the zone below via
+# RFC2136 because the zone sets dynamicUpdate (allow-update { key ... }).
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindCluster
 metadata:
   name: externaldns
   namespace: bind-externaldns
 spec:
-  mode: dynamic
+  mode: authoritative
   replicas: 3
   service:
     type: LoadBalancer