Add a parameter to `bind::zone` which indicates whether a zone is dynamic or
not. This has the effect of allowing puppet to manage the zone file rather than
simply initialize it. This change also introduces more appropriate handling of
slave and stub zones, so that puppet will not populate a stock zone file,
forcing the nameserver to do a zone transfer when a zone is created.
Also, there is now a substancial amount of validation in the `bind::zone` class
in order to prevent invalid parameter combinations, so that validity may be
assumed elsewhere in the manifest and in the configuration template.
This adds a 'dnssec' parameter to the bind::zone define which causes the module
to generate keys and sign the zone. Some caveats and breaking changes:
1) Existing non-signed zones will have to be manually moved and signed
2) Signed zones are treated as dynamic
