feat: allow skipping external-dns target updates

[PKizzle]

Summary

• add dynamic-prefix.io/no-external-dns-target-update=true to opt out of managed external-dns target changes in HA mode
• continue updating the managed Cilium IP annotation even when the external-dns target is left untouched
• add focused tests for the opt-out behavior

Testing

• ran focused ServiceSync controller tests

Note

• this branch currently includes the unmanaged dual-stack preservation groundwork from feat: preserve unmanaged dual-stack entries #9 because the opt-out behavior lives in the same HA sync path

Closes #5

[jr42]

Thanks! Clean opt-out mechanism for external-dns.