fix(site): validate alias domain names on site create

[mrrobot47]

Summary

ee site create --type=php --alias-domains stored the list as given: blank entries (a.com,,b.com,) ended up in VIRTUAL_HOST and the nginx server_name, and names like ../evil, a..b, a.com. or default reached the per-domain proxy files, where default maps onto the global auth and ACL files. Alias domains are now split and validated with the helpers from site-command, the same way html sites and ee site update do.

Changes

• Split --alias-domains with site-command's split_alias_domains(), which trims the names and drops blank entries. A flag passed without a value no longer becomes the alias domain 1.
• Check the alias domains with site-command's validate_alias_domains() and exit with an error listing the invalid names before anything is created.

Release / merge order

These PRs ship together in one core release:

• fix(nginx-proxy)!: apply wildcard htpasswd and ACL only to *.X hosts dockerfiles#354: new easyengine/nginx-proxy template (needs a new dockerfiles tag)
• feat(auth): support http auth and ip whitelist on wildcard subdomains and alias domains auth-command#57: wildcard and alias domain auth files, alias domain hooks, upgrade migration
• feat(site): add alias domain hooks and validate alias domain names site-command#502: alias domain hooks, alias domain validation, delete cleanup left to auth-command
• fix(site): validate alias domain names on site create site-type-wp#239 and fix(site): validate alias domain names on site create #114: alias domain validation on site create

Order:

1. Merge the dockerfiles PR, tag a new dockerfiles release and confirm the new easyengine/nginx-proxy image is on Docker Hub.
2. Merge the site-command, auth-command, site-type-wp and site-type-php PRs close together (nightly and PR CI build dev-develop of every package) and tag each package.
3. In one core release, bump the four package pins and easyengine/nginx-proxy in img-versions.json together.

Why they are coupled:

• auth-command's container migration regenerates every site's auth files on upgrade and needs the new nginx-proxy image in the same release: the old template applies a _wildcard.X file to sibling sites too (e.g. shop.example.com picks up _wildcard.example.com).
• auth-command syncs alias domain auth files from the site_alias_domains_before_update, site_alias_domains_updated and site_alias_domains_update_failed hooks, which only the new site-command fires.
• site-command no longer removes a site's auth files and rows on site delete; auth-command's site_cleanup hook (autoloaded since feat(auth): support http auth and ip whitelist on wildcard subdomains and alias domains auth-command#57) does it.
• site-type-wp and site-type-php call site-command's new split_alias_domains() and validate_alias_domains(); with an older site-command, site create fails with a fatal "undefined function" error.
• The dockerfiles change is breaking for hand-made feat(nginx-proxy): Add wildcard HTTP auth support for WordPress multisite dockerfiles#298-style _wildcard.X files that were also relied on to protect X itself: X now needs its own htpasswd/X (and vhost.d/X_acl) file.

Testing

• Tested on a live EasyEngine 4.12 install with html, php, wp, wp subdir and wp subdom sites, with plain and *. aliases, multiple users, global auth, IP whitelists, alias add/remove, site delete, self-signed SSL and Let's Encrypt.
• PHP 7.4–8.5 lint.