Fix regex domain name validation

[inteon]

In TPP, we are used to specifying ".example.com" in the allowed domains, this restriction matches all subdomains of example.com, without matching example.com itself.
vCert does however not translate this rule into regex correctly, causing errors like the following:

Failed to request venafi certificate: common name test.example.com is not allowed in this policy: [^([\p{L}\p{N}-*]+\.)*\.example\.com$]

This PR fixes the regex generation logic and adds a test for this fix.

[hawksight]

Helps resolve this open-source issue

[wallrj]

Thanks @inteon

This PR seems useful in its own right.
Why not separate it from the duration PR, which I think is less useful?

[wallrj]

Thanks Tim,

/lgtm