Avoid single point-of-failure for our GeoIP domain

We don't want mirror.pkgbuild.com's DNS server to be a single-point-of-failure, so this commit adds multiple authoritative DNS servers for the zone. The extra DNS servers are run on the geomirror servers.

The _acme-challenge zone, used for obtaining certificates, is run solely on mirror.pkgbuild.com's DNS server, to avoid syncing DNS records between the servers (KISS).

host_vars/mirror.pkgbuild.com/misc

 ---
 mirror_domain: mirror.pkgbuild.com
 mirror_debug_packages: false
+geomirror_acme_challenge: true
 archweb_mirrorcheck_locations: [20, 21]
 filesystem: btrfs