Unify resources.ValidateActorID with the ValidateActorRef rules from #206

#206 (in review) adds DNS-1123 validators to `internal/resources` using k8s.io/apimachinery, including `ValidateActorRef`, which checks actor IDs with the same DNS-1123 label rule that the existing `ValidateActorID` implements with a hand-rolled regex. Once #206 merges, the package will contain two implementations of one rule, which can drift.

Unify them on a single implementation. This was deliberately kept out of #206 because it changes ate-api-server's client-facing error responses: `ValidateActorID` returns hand-written rule prose, while the apimachinery validators return generated messages, so the consolidation needs a decision about which error text API clients see.

While here, consider applying the other #206 validators (`ValidateActorRef`, `ValidateRunscHash`, `ValidateSnapshotURIPrefix`) at the API server and controller boundaries. Every one of these values originates in user-supplied API/CRD data, so bad values can be rejected at admission time instead of at actor-activation time deep in atelet.

Blocked on #206 merging.