fix(kms): validate onboarding domains

[kvinwang]

Problem

KMS onboarding accepted DNS/domain values without validating their syntax and expected relationship. Invalid or attacker-controlled names could flow into certificate issuance and service configuration, causing late issuance failures or binding credentials to the wrong name.

Root cause and fix

Validate onboarding domains at the RPC boundary and reject malformed or inconsistent values before any key/certificate state is committed.

Implementation

The branch records the following focused implementation work:

• fix(kms): validate onboarding domains
• fix(kms): integrate onboarding domain tests

Changed paths:

• dstack/kms/src/onboard_service.rs

Scope

This PR addresses one logical kms finding. It intentionally excludes the acceptance-test infrastructure from #841 and unrelated product fixes from #840.

Dependency and merge order

This PR is based directly on master and does not require another split product PR to merge first.

Verification

• git diff --check origin/master..origin/codex/fix-kms-onboarding-domains: passed.
• The declared base was verified as an ancestor of the PR head.
• Focused compile/check verification was run for the changed component where applicable; non-Rust packaging or configuration changes were reviewed against their exact branch delta.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.