roles/named: Support global forwarders

The *named* role now supports configuring BIND to use forwarders for
recursive queries instead of or in addition to the root nameservers.

roles/named/templates/named.conf.j2

@@ -37,6 +37,18 @@ options {
 
 	dnssec-enable {{ yesno(named_dnssec) }};
 	dnssec-validation {{ yesno(named_dnssec_validation) }};
+{% if named_forwarders is defined %}
+{% if named_forward_only|d|bool %}
+	forward only;
+{% else %}
+	forward first;
+{% endif %}
+	forwarders {
+{% for host in named_forwarders %}
+		{{ host }};
+{% endfor %}
+	};
+{% endif %}
 
 	managed-keys-directory "{{ named_managed_keys_dir }}";