swarm: refuse swarm.hives keys that are not valid hive identifiers

A hive key becomes a certificate subject and a directory name, but only the
reserved-name and fragment guards looked at it, so `a/b` or `../x` evaluated
and misbehaved later. Assert at eval time that every key is 1-63 characters
of [a-z0-9-], the rule `Ident` applies in hive-types, and name the offending
keys in the message.

nix/host-modules/lib/name-guards.nix

@@ -63,4 +63,27 @@ in
       problem = "has name(s) containing a reserved word";
       forbiddenLabel = "Forbidden as substrings";
     };
+
+  # Every name must be a valid hive `Ident` (hive-types/src/lib.rs): 1-63
+  # characters of `[a-z0-9-]`, with no leading-character rule. A hive name is
+  # spliced into certificate subjects and filesystem paths, where `/` and `..`
+  # change meaning.
+  mustBeIdent =
+    { option, names }:
+    let
+      offenders = lib.filter (n: builtins.match "[a-z0-9-]+" n == null || lib.stringLength n > 63) names;
+    in
+    {
+      assertion = offenders == [ ];
+      message = ''
+        ${option} has name(s) that are not valid identifiers: ${
+          lib.concatMapStringsSep ", " (x: "'${x}'") offenders
+        }
+        Required: 1-63 characters, each one of [a-z0-9-]
+
+        A hive name becomes a certificate subject and a directory name, so a
+        `/` or `..` in it names something else. `Ident` in
+        hive-types/src/lib.rs applies the same rule. Rename the hive.
+      '';
+    };
 }

nix/host-modules/swarm.nix

@@ -369,6 +369,10 @@ in
           designed for it.
         '';
       }
+      (nameGuards.mustBeIdent {
+        option = "services.hyperhive.swarm.hives";
+        names = hiveNames;
+      })
       (nameGuards.mustNotEqual {
         option = "services.hyperhive.swarm.hives";
         names = hiveNames;