fix(icinga): default Director base templates to the master zone

[NavidSassan]

What

Default the shipped Icinga Director base templates to the master zone, so host and service configuration (and any credentials on those objects) stays on the master instead of being distributed to every agent.

• tpl-service-generic and tpl-host-generic: zone → "master". Every other host/service template inherits it through the imports, so these two are the single control point for the whole tree's zone.
• tpl-service-cert-no-agent and tpl-service-url-no-agent: zone → null (they now inherit master like everything else, removing the previous hand-pinned inconsistency).
• No build-basket change: per-plugin and -no-agent templates stay zone-less and inherit.

Why

With the base templates zone-less, Director placed them in the global zone and every host/service inherited global, so a credential set on a host or service object was copied to every agent's on-disk config. A silent credential leak to all agents is a worse failure mode than a loud, documented config rejection.

Trade-off

This reverses the zone drop from #721. Single-node and flat master → agent setups are unaffected and now keep config on the master. Distributed setups with satellite- or agent-authoritative hosts fail loudly, because the master zone is never synced downwards, so those nodes cannot import the master-zoned templates. Such sites unset the zone on the two base templates to move them back to the global zone, accepting the credential distribution that entails. This is documented in ICINGA.md.

Verification

Behaviour confirmed against the icinga2 and icingaweb2-module-director sources:

• Zone is an inheritable config attribute (configobject.ti), so pinning the two base templates propagates master to the whole tree.
• Config sync only pushes global and child zones downwards, never the master (parent) zone (apilistener-filesync.cpp), which is why satellite/agent-authoritative hosts cannot import master-zoned templates.
• The two exact deploy errors are quoted verbatim in ICINGA.md so they are greppable: Import references unknown template: '...' (expression.cpp) and Command endpoint must be in zone '...' or in a direct child zone thereof (checkable.cpp).
• Service Sets render as apply rules and always go to the global zone, so a credential on a Service Set is never protected; documented accordingly.

mkdocs build --strict passes.

Docs

• ICINGA.md: Distributed Monitoring section rewritten (single control point, config-sync reality, both exact error messages, distributed remediation, Service Set secret caveat); troubleshooting note updated.
• CONTRIBUTING.md: matching contributor guidance.
• CHANGELOG.md: admin-facing entry.

Closes #721.