If you try to change the DNS prefix with the configuration before this
change, `terraform apply` will fail with a message to this effect.

This validation is not done in the CLI, so creating a cluster with a DNS
prefix that does not fulfill these requirements will not fail. However,
in some cases such a cluster will be badly broken; for example, if the
specified DNS prefix has subdomain parts (e.g. foo.bar.baz), certificate
validation will fail when communicating with the cluster, resulting in
broken behavior for commands such as kubectl logs.

Because of the seriously broken state a cluster can end up in, and since
the cluster will have to be completely recreated in order to change the
DNS prefix, I think it's worthwhile to implement this validation even
before the CLI has been patched to include it.

The source for the validation rules (and error message) is the client-
side validation error message in the Azure Portal, where validation is
already implemented.