Refuse a hostname that would match hosts the service was never given

[Shine-neko]

parse_hostnames split on commas, trimmed, and dropped empties. Nothing checked the shape of what came out, and Sozu reads two of those shapes as patterns:

• a name containing / becomes a regex (DomainRule::Regex)
• a bare * becomes DomainRule::Any

So a container that can set its own labels could claim the whole proxy:

sozune.http.evil.host: "/.*/"

Frontends are installed at RulePosition::Pre, ahead of every legitimate route, so that one rule captures other tenants' traffic — credentials and session cookies included. The same applies to an entrypoint served by the HTTP provider, which deserializes straight into the store.

ACME already refused these shapes in validate_hostname; the routing path had no equivalent gate. It does now, on both doors: the label parser emits E002 and refuses the entrypoint, and the HTTP provider drops it with a warning naming the offending value. A leading *. stays accepted — that is a wildcard Sozu handles natively, and the shape ACME already allows.

One bad name refuses the whole label rather than silently routing the rest, so an operator sees the mistake instead of half a route.

Sixth of the findings from a full audit, after #140 to #144.