swarm: refuse swarm.hives keys that are not valid hive identifiers

A hive key becomes a certificate subject and a directory name, but only the
reserved-name and fragment guards looked at it, so `a/b` or `../x` evaluated
and misbehaved later. Assert at eval time that every key is 1-63 characters
of [a-z0-9-], the rule `Ident` applies in hive-types, and name the offending
keys in the message.

nix/host-modules/swarm.nix

@@ -369,6 +369,10 @@ in
           designed for it.
         '';
       }
+      (nameGuards.mustBeIdent {
+        option = "services.hyperhive.swarm.hives";
+        names = hiveNames;
+      })
       (nameGuards.mustNotEqual {
         option = "services.hyperhive.swarm.hives";
         names = hiveNames;