Add a way to define restrictions on which zones may be added via catalog zone

Implement a new catalog zones configuration option allowed-member-zones, which lets to restrict the allowed member zone names for a given catalog zone. It is possible to use wildcard and negated names in the list.

Closes #751