fix(controller): validate Cluster.hosts field as comma-separated hostnames

Includes unit tests.

Fixes #1552.