Allow root admin to configure DNS servers on behalf of a specific user/domain and support project-scoped DNS servers

### The required feature described as a wish

Currently, a DNS server can only be set up for the calling account/domain, there is no way for a root admin to configure one on behalf of a different account or domain, and no way for a DNS server to belong to a project.

As a root admin, I would like to be able to:

1. Set up a DNS server on behalf of a specific user/account
2. Set up a DNS server on behalf of a specific domain
3. Attach a DNS server to a project

Additional constraint:

4. If a DNS server was set up by root admin on behalf of a user/domain, that user/domain should not be able to modify its URL themselves. Only root admin (or whoever provisioned it) should be able to change it.

Motivation:

Asks 1 and 2 are primarily driven by the recent restriction that only root admin can configure a DNS server on a private/internal (RFC1918) address, domain admins and regular users can no longer do so directly (see [PR #13821](https://github.com/apache/cloudstack/pull/13821/commits/1545adde35dd68a90291687fc3f7cec23b1e13f6)). Without a way for root admin to provision such a server on behalf of another account/domain, that use case is lost entirely for non-root-admin users.

Ask 3 (project support) wasn't part of the initial scope for this feature. It's being tracked here as a follow-up enhancement rather than a gap in the original design.

Ask 4 follows directly from 1 and 2: if the owning user/domain could freely change the URL afterward, they could redirect an admin-provisioned DNS server anywhere they like, defeating the purpose of restricting private-address setup to root admin in the first place.

Bắt đầu bằng cách xem xét luồng cấu hình DNS-server hiện có và PR #13821, sau đó lần theo cách quyền sở hữu account, domain, project và root-admin được biểu diễn. Công việc được xem là hoàn tất khi root admin có thể provision DNS server cho user, domain hoặc project, trong khi user và domain đã được provision không thể thay đổi URL của mình; các quy tắc về phạm vi và quyền cần được bao phủ bằng các test phù hợp.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.