feat: Reject ALIAS records at wildcard names

[scotwells]

Summary

A wildcard ALIAS record used to be accepted and published but never resolved, because the DNS server only expands an ALIAS when the query name matches the record exactly. It is now rejected at write time with a message pointing to CNAME, which works at wildcards.

User experience

Before: this was accepted, and queries under app never resolved.

apiVersion: dns.networking.miloapis.com/v1alpha1
kind: DNSRecordSet
metadata:
  name: wildcard-app
spec:
  dnsZoneRef:
    name: my-zone
  recordType: ALIAS
  records:
    - name: "*.app"
      alias:
        content: target.example.net.

After: the same object is rejected on create and update.

The DNSRecordSet "wildcard-app" is invalid: spec.records[0].name: Invalid value: "*.app": ALIAS records cannot be used at wildcard names; use a CNAME for "*.app"

Unchanged: CNAME, A and AAAA at wildcards, and ALIAS at the apex (@) or an exact name like www. A wildcard ALIAS that is already stored stays editable on updates that do not add it; only newly added wildcard ALIAS names are refused.

Test plan

• ALIAS at *, *.app and an FQDN wildcard is rejected on create
• Adding a wildcard ALIAS, or changing a wildcard CNAME to ALIAS, is rejected on update
• CNAME, A and AAAA at wildcards, and ALIAS at @ and www, are accepted
• make lint clean; webhook tests pass (the pdns integration tests need Docker and were not run)

Fixes #226