Require delegated domains to be in a zone

Without this validation, a user could set a domain as delegated without
realizing that Cyder wouldn't actually build the NS and glue records,
causing the domain not to be delegated.