Add hostname validation to certs uploaded to nexus

[jgallagher]

This PR changes the CertificateValidator from taking "0 or 1" hostname to validate to taking a list of hostnames, and the cert passes validation if any hostname from the list matches. This is to support a future world where we support adding and removing external DNS zone names, where an operator might perform an operation like:

1. The rack has an external name of myrack.oxide.computer, and every silo has a $SILO.sys.myrack.oxide.computer cert
2. Add a new external name of something-else.oxide.computer
3. Upload new certs to all silos with SAN $SILO.sys.something-else.oxide.computer
4. Remove the external name myrack.oxide.computer

To be clear this is a hypothetical world, because today we don't support modifying the external DNS name at all. But step 3 from this sequence is the argument for why the validation logic is "any of the hostnames" instead of "all of the hostnames": we want to add certs for the new hostname (that don't need to also work for the old hostname we're about to remove).

The check is performed three places:

1. When the recovery silo is created (which is maybe wrong? I could see an argument for omitting this check, although since wicket is also performing it it should certainly pass)
2. When any other silo is created
3. When a cert is uploaded to an existing silo

In all cases we build the list of hostnames for the validator by combining the list of external DNS zone names (which is currently always length 1) with the silo's .sys prefix. For the recovery silo specifically we build the list of length 1 by hand; for other silos and when adding to an existing silo, we query CRDB for all external DNS zone names.

I haven't yet deployed this to a full system and want to do that before merging, but this passes tests and we're about to have a busy week, so I wanted to go ahead and open it as an easy way to keep it on the radar.

Fixes #4045.

[luqmana]

Thanks for hooking up the rest of this!

[luqmana]

Thanks John!