fix(cli): bootstrapping qualifier length not validated (#10121)

The qualifier has a quite restricted length. Validate the length (and
character set) of the qualifier that the user supplies.

Fixes #9255.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml

@@ -28,6 +28,10 @@ Parameters:
     Description: An identifier to distinguish multiple bootstrap stacks in the same environment
     Default: hnb659fds
     Type: String
+    # "cdk-(qualifier)-image-publishing-role-(account)-(region)" needs to be <= 64 chars
+    # account = 12, region <= 14, 10 chars for qualifier and 28 for rest of role name
+    AllowedPattern: "[A-Za-z0-9_-]{1,10}"
+    ConstraintDescription: Qualifier must be an alphanumeric identifier of at most 10 characters
   PublicAccessBlockConfiguration:
     Description: Whether or not to enable S3 Staging Bucket Public Access Block Configuration
     Default: 'true'

packages/aws-cdk/test/integ/cli/bootstrapping.integtest.ts

@@ -6,7 +6,7 @@ import { integTest } from './test-helpers';
 
 jest.setTimeout(600_000);
 
-const QUALIFIER = randomString();
+const QUALIFIER = randomString().substr(0, 10);
 
 beforeAll(async () => {
   await prepareAppFixture();