fix(operator): substitute RATE_LIMIT in cluster-level named.conf.options

[ebourgeois]

Problem

#466 added the {{RATE_LIMIT}} placeholder to templates/named.conf.options.tmpl and substituted it in the instance-level builder (build_options_conf), but not in the cluster-level builder (build_cluster_options_conf). Every cluster ConfigMap therefore shipped the literal placeholder, and named exited at startup:

/etc/bind/named.conf.options:20: '}' expected near '{'
loading configuration: unexpected token
exiting (due to fatal error)

The bind9 operand container crash-loops, pods never become Ready, and the e2e suite fails (test_instance_pod_label_selector_finds_pods: pods never Ready within 4 minutes) — on main itself and on every PR rebased onto it (currently blocking dependabot PRs #461–#465).

Root-cause verification (local, kind)

• Reproduced on main (53df509): 11 passed, 1 failed — same test as CI.
• Pre-Harden DNS defaults: RRL on by default, deny AXFR without an explicit ACL (P1-3, P1-4) #466 commit (2d8d7b4): full integration suite passes.
• Patching the live ConfigMap to substitute the placeholder: operand pod goes 2/2 Ready in ~30s.

Fix

• build_cluster_options_conf now renders rate-limit from spec.global.rateLimit (default 15/s per source /24, responsesPerSecond: 0 disables) and substitutes {{RATE_LIMIT}}, matching the instance-level builder.
• Regression test asserts the default directive is rendered and that no template placeholder survives substitution — the existing cluster-config tests only checked forwarders/listen-on, which is why 47/47 unit tests passed with this bug.

Note (follow-up, not in this PR)

The cluster-level builder also never received the allow-transfer { none; } deny-by-default from #466 — same class of gap, separate change.

Test plan

• cargo test --all — 1300+ tests green, incl. new regression test
• cargo fmt --check, cargo clippy --all -- -D warnings — clean
• Local kind e2e on main reproduced the failure; ConfigMap patch confirmed the fix path