Blueprint planner: wait for old zone shutdown when upgrading external DNS and boundary NTP

Today, when updating an external DNS or boundary NTP zone, Reconfigurator's planner will expunge the old one then start a new one; however, it does not wait for the expunged one to be confirmed-shut-down before starting the new one. Chatting with @bnaecker today, we think this is kinda-sorta-okay-probably-most-of-the-time, in that we end up with a sequence like this:

1. We have a target blueprint that marks external DNS zone A servicing external IP X as expunged, and adds a new external DNS zone B that is also responsible for servicing external IP X
2. Blueprint execution does two relevant things:

• update the external_ip / network_interface tables accordingly: delete the records for zone A, insert records for zone B
• push new sled configs to the sleds hosting A and B (or the one sled, if both A and B are on the same sled)

3. Later, one of the dendrite-related bg tasks updates dendrite's records to note that IP X is associated with zone B, not zone A

Because we don't wait for A to be shutdown, we could have some weird intermediate states:

• The sled hosting zone B could start B before the sled hosting zone A has shut A down. Which one dendrite directs traffic to depends on whether we've made it to step 3.
• If A and B are on the same sled, normally the config reconciler will shut down A before starting B. If shutting down A fails, today the config reconciler won't attempt to start any new zones at all, but this is noted as a conservative choice. If we changed that without taking this situation into account, we could end up trying to create two OPTE ports both associated with the same external IP; we're not sure what would happen in that case.

It seems like a safer choice to wait for the old zone to be shutdown before reusing its IP. This is already what we do for internal DNS, where starting the new zone on the same IP as the old one caused real problems.

Start in the Reconfigurator planner and trace how external DNS and boundary NTP zones are expunged and replaced. Compare this flow with the existing internal DNS shutdown handling, then verify that a replacement zone is not started until the old zone is confirmed shut down and its IP can be safely reused.