SecurityGroup: port ranges and malformed FQDNs are rejected with misleading errors #5130

Describe the bug

Two SecurityGroup inputs are rejected, but not with the error the SecurityGroup API is meant to return:

1. A port range such as "80-90" is rejected with must contain at least one letter (a-z): validatePortRules falls through to IsValidPortName for any non-numeric value, so a range is reported as a bad port name. Ranges are not supported, and the message should say so.
2. A malformed FQDN (matchName: "not a domain!!") passes validateFQDNs, which only checks that one of matchName/matchPattern is set, and is then rejected by the CiliumNetworkPolicy CRD schema. The client sees The CiliumNetworkPolicy "<name>" is invalid: spec.egress[0].toFQDNs[0].matchName ..., which leaks the backing resource the API is designed to hide (pkg/apis/sdn/DESIGN.md §8 lists FQDN syntax as deferred).

Environment

• Cozystack v1.6.5
• Provider: on-prem

To Reproduce

1. Create a SecurityGroup with ingress: [{fromCIDR: ["10.0.0.0/8"], toPorts: [{ports: [{port: "80-90"}]}]}].
2. Create a SecurityGroup with egress: [{toFQDNs: [{matchName: "not a domain!!"}]}].

Expected behaviour

Both are rejected by the SecurityGroup validation, with a field error on the SecurityGroup path that names the actual problem (port ranges are not supported; the name is not a valid DNS name or pattern).

Actual behaviour

The SecurityGroup "v-range" is invalid: spec.ingress[0].toPorts[0].ports[0].port: Invalid value: "80-90": must contain at least one letter (a-z)
The CiliumNetworkPolicy "v-fqdn2" is invalid: spec.egress[0].toFQDNs[0].matchName: Invalid value: "not a domain!!": spec.egress[0].toFQDNs[0].matchName in body should match '^([-a-zA-Z0-9_]+[.]?)+$'

Checklist

• I have checked the documentation
• I have searched for similar issues
• I have included all required information
• I have provided clear steps to reproduce
• I have included relevant logs