test: sandboxed docker-compose stack for plugin smoke testing

Brings up a parallel CoreDNS instance on ports 11053/19153 with a
single test.example.com zone. Useful for verifying the custom image
builds and the rfc2136 plugin accepts/applies UPDATEs end-to-end
before touching production zones.

Already validated the msgAcceptFunc override fix end-to-end via
nsupdate, with the auto plugin re-serving the new record within 5s.

Note: zones/test.example.com.zone gets rewritten by the plugin
during testing. If perms get hosed (docker writes as root), run
sudo chown -R rpm:rpm test/zones/ to reclaim.

test/docker-compose.yml

@@ -0,0 +1,27 @@
+services:
+  # Custom CoreDNS build with the rfc2136 plugin baked in.
+  # The Dockerfile lives in the parent dir (../coredns/Dockerfile) so
+  # we reuse the production build artefact.
+  coredns:
+    build:
+      context: ..
+      dockerfile: coredns/Dockerfile
+    image: coredns-rfc2136-test:dev
+    container_name: coredns-rfc2136-test
+    restart: "no"  # never auto-restart in test scenarios
+    command: ["-conf", "/etc/coredns/Corefile"]
+    environment:
+      - ACME_TSIG_SECRET=${ACME_TSIG_SECRET}
+    ports:
+      - "${TEST_DNS_PORT}:53/udp"
+      - "${TEST_DNS_PORT}:53/tcp"
+      - "${TEST_METRICS_PORT}:9153/tcp"
+    volumes:
+      - ./Corefile:/etc/coredns/Corefile:ro
+      - ./zones:/zones      # NOT read-only: rfc2136 needs to write here
+    healthcheck:
+      test: ["CMD", "/coredns", "-version"]
+      interval: 10s
+      timeout: 3s
+      retries: 3
+      start_period: 5s