policy: strengthen bundle id validation

[Redent0r]

Ensure bundle id read from annotation matches expected format

Merge Checklist

• Followed patch format from upstream recommendation: https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md#patch-format
  • Included a single commit in a given PR - at least unless there are related commits and each makes sense as a change on its own.
• Aware about the PR to be merged using "create a merge commit" rather than "squash and merge" (or similar)
• The upstream/missing label (or upstream/not-needed) has been set on the PR.

Summary

Test Methodology

test run: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=706792&view=results