fix: Serve DNSRecordSet webhooks on every replica

[vvoytovych]

The DNSRecordSet webhooks read each record set's zone from its project, but only the elected replica connects to projects. Any other replica finds no zone and admits the record set without its display annotations.

This connects every replica to its projects, and keeps a new pod unready until its webhook server serves and its projects are connected.

Change	Effect
Every replica connects to its projects, not only the elected one	a replica that is not the leader answers webhook calls as the leader does
Readiness waits for the webhook server and for the projects found at start	during a rollout the old pod keeps serving until the new one can answer

• With one replica and leader election off, as deployed today, a replacement still refuses writes until the new pod is ready. That pod is now ready only once its projects are connected, about two minutes judging by network-services-operator's pods (not measured here). Running two replicas, a later step, removes the gap.
• A replica connects to projects the way network-services-operator's does.
• The provider is kept from starting a second time only for the leader's sake. There, a second start was measured to change nothing.

Test plan

• Locally, the tamper test fails on main's wiring and passes with the change: a non-leader replica reads the zone from the project, and stays unready until its webhook serves
• Locally, as deployed today (one replica, no leader election), the replicator reconciles a project's zone and the webhook annotates a record set, on main's wiring and with the change
• Removing the connection on every replica, or either readiness check, fails a test, also with leader election off
• CI passes on this branch

Related to #252