Allow users to set hosts to the wildcard specifier when TLS is disabled

[crhino]

This allows easier demoing/testing of ingress gateways, while still
preserving the validation we have for DNSSANs

In #7990, we defaulted to always requiring a host header, even if only 1 service is exposed, so that adding another service to the configuration would not accidentally break traffic flows. However, that then made it hard to test ingress gateways using a single service by requiring the correct Host header always.

With this PR, a config like so is valid:

Kind = "ingress-gateway"
Name = "ingress-gateway"
Listeners = [
  {
    Port = 80
    Protocol = "http"
    Services = [
      {
        Name = "web"
        Hosts = ["*"]
      }
    ]
  }
]

and this allows a user to send traffic to the ingress gateway and see it reach the web service without having to specify a specific host.

We disallow * host when TLS is enabled, because we want all hosts to be valid DNSSAN records.

[mkeeler]

LGTM