named: Support `update-policy` clause in the zone configuration template

[brlin-tw]

The update-policy clause supports fine-grained rules on which identity can update which (types of) resource records. It would be great if the bind role could support it.

Also see 7.4. Dynamic Update Security — 7. Security Configurations — BIND 9 9.20.13 documentation