Set key-directory in named.conf

Tell bind where to find DNSSEC keys for re-signing when
dynamic updates are used.

roles/float-infra-dns/templates/bind/named.conf.options

@@ -30,6 +30,9 @@ options {
 
   dnssec-validation auto;
 
+  // For re-signing with dynamic updates.
+  key-directory "/etc/credentials/dnssec";
+
   notify no;
   rrset-order { order random; };