Sets DNS_UPDATER_DENY_RANGES so the daemon never publishes records whose
address is in the k8s pod CIDR (10.42.0.0/16), service CIDR (10.43.0.0/16), the
LB VIP pool (198.18.200.0/24) or 198.18.199.0/24 — keeping kube-lb0/flannel/etc.
and their reverse PTRs out of the authoritative zones and stopping NOTAUTH
updates for zones we do not host. Exposes deny/allow ranges+domains as class
params. Also bumps package_ensure to 'latest' so hosts pick up the filter
release (rpm-internal metadata_expire is 1h).
unkinben