Validate user and role names instead of munging binding names

Rancher requires global role binding names to be RFC 1123 labels. The
per-user binding name lowercased the key and replaced only "/", so
usernames containing ".", "_" or "@" still produced an invalid name and
failed at apply, and hyphenated names could collide (foo-bar + baz vs
foo + bar-baz) into one object.

Add validation blocks on var.users requiring the username and every
referenced role name to be RFC 1123 labels, so non-compliant input fails
the plan with an actionable message. The binding name is then built from
the two parts directly. A precondition rejects the remaining hyphen
ambiguity at plan time rather than as a mid-apply conflict. Document the
constraint in the users schema section of the README. The group binding
path is unchanged.

README.md

@@ -50,6 +50,15 @@ global_role_bindings:       # optional
 The password is read from Vault **at plan time**, so seed the kv-v2 secret
 before adding the file, or the plan fails.
 
+The file name (the username) and every entry in `global_role_bindings` must be
+an RFC 1123 label — `^[a-z0-9]([a-z0-9-]*[a-z0-9])?$`, i.e. lowercase
+alphanumerics and `-`, starting and ending alphanumeric. No `.`, `_`, `@` or
+uppercase. Rancher names each binding `akuser-<username>-<role>` and rejects
+anything else, so non-compliant values fail the plan with an explicit error
+instead of the apply. Names that are individually valid but collapse to the same
+binding name (e.g. `foo-bar` + `baz` and `foo` + `bar-baz`) are rejected at plan
+time too.
+
 ### `config/roles/<name>.yaml`
 
 ```yaml