fix(sandbox): allow first-label L7 host wildcards

[mjamiv]

Summary

• allow L7 host validation to accept single-star globs inside the first DNS label, such as *-aiplatform.googleapis.com
• keep rejecting bare global wildcards, TLD/single-label wildcards, wildcards outside the first DNS label, and recursive ** inside a label
• add regression coverage for accepted and rejected wildcard host patterns

Related Issue

Fixes #1303

Changes

• Extracted L7 host wildcard validation into a helper.
• Replaced the stricter *. / **. prefix requirement with label-position validation that matches the OPA glob.match(..., ["."]) boundary model.
• Added unit coverage for *-aiplatform.googleapis.com, **.example.com, foo.*.example.com, foo**.example.com, *com, bare */**, and TLD wildcards.

Testing

• mise run pre-commit
• cargo fmt --all -- --check
• git diff --check
• cargo test -p openshell-sandbox validate_wildcard_host -- --nocapture
• cargo test -p openshell-sandbox
• cargo clippy -p openshell-sandbox --all-targets -- -D warnings

Checklist

• Tests added or updated
• Formatting checked
• Related issue linked

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[johntmyers]

This changes the documented host wildcard contract, but architecture/security-policy.md still says host wildcard patterns must start with *. or **. and still documents TLD wildcards as a warning. Please update the Host Wildcards section and validation tables to include first-label intra-label patterns like *-aiplatform.googleapis.com, and to match the current error behavior for TLD/single-label wildcard patterns.

The validator test covers *-aiplatform.googleapis.com, but the OPA runtime tests still only cover *.example.com-style host wildcards. Please add a runtime test asserting *-aiplatform.googleapis.com allows a host like us-central1-aiplatform.googleapis.com and does not cross . boundaries. That would lock the validator/runtime alignment this PR is fixing.