Catalog Zone Changes

[ShaneMcC]

Our current catalog zone is based on what bind 9.11 implemented.

Bind 9.15 (and subsequently, 9.16) will likely update their implementation based on the latest version of the drafts, so we should make sure we generate valid zones (https://datatracker.ietf.org/doc/draft-muks-dnsop-dns-catalog-zones/).

Some things of note:

• The SHA1-of-wire-format is not strictly required, and can be any unique per-zone string. (We may want to for example use our internal domain-id to make the zones nicer to read
• We currently define the allow-transfer record as a single APL, but this should be separate as per https://tools.ietf.org/id/draft-muks-dnsop-dns-catalog-zones-04.html#sec-network

[ShaneMcC]

Catalog zones are now a full RFC not just a draft:

https://datatracker.ietf.org/doc/rfc9432/

[ShaneMcC]

Looks like version 1 is still supported by bind.

Between draft -04 and the final RFC the requirement for APLs was dropped and this looks to now just be implemented the same way it used to be except now under allow-transfer.ext not allow-transfer.

Given that V1 is still supported in modern bind, we don't really need to change anything here.