fix(controller): validate Cluster.hosts field as comma-separated

Includes unit tests.

Fixes #1552.