util/dnsname: ToFQDN doesn't validate labels

the `dnsname` package contains:

```
func ToFQDN(s string) (FQDN, error) {
```

It validates things like the total length (253) and per-label length (63) but doesn't validate that the labels aren't binary gibberish.

There's also:

```
// ValidLabel reports whether label is a valid DNS label.
func ValidLabel(label string) error {
```

But `ToFQDN` doesn't use that.

/cc @danderson @maisem

Start with the util/dnsname package and inspect ToFQDN alongside ValidLabel. Trace which validation ToFQDN currently performs, then verify that invalid label contents are rejected consistently; completion means ToFQDN no longer accepts binary-gibberish labels.

Written by the indexing model from the issue text.