policy/v2: validate SSH test sources and destinations like SaaS

Reject address-range sources and autogroup:member destinations.

integration/cli_policy_test.go

@@ -201,8 +201,8 @@ func TestPolicyCheckCommand(t *testing.T) {
 
 // TestSSHTestsRejectFailingPolicy asserts `headscale policy set` rejects
 // a policy whose sshTests fail, surfaces the engine's "test(s) failed"
-// sentinel, and leaves the stored policy unchanged. autogroup:member as
-// dst lets every scenario node count, so no tagged node is needed.
+// sentinel, and leaves the stored policy unchanged. The tests name user1's
+// node by its user, so no tagged node is needed.
 func TestSSHTestsRejectFailingPolicy(t *testing.T) {
 	IntegrationSkip(t)
 
@@ -226,7 +226,7 @@ func TestSSHTestsRejectFailingPolicy(t *testing.T) {
 		SSHTests: []policyv2.SSHPolicyTest{
 			{
 				Src:    usernamep(user1),
-				Dst:    policyv2.SSHTestDestinations{new(policyv2.AutoGroupMember)},
+				Dst:    policyv2.SSHTestDestinations{usernamep(user1)},
 				Accept: []policyv2.SSHUser{policyv2.SSHUser("root")},
 			},
 		},
@@ -238,7 +238,7 @@ func TestSSHTestsRejectFailingPolicy(t *testing.T) {
 	badPolicy.SSHTests = []policyv2.SSHPolicyTest{
 		{
 			Src:    usernamep(user2),
-			Dst:    policyv2.SSHTestDestinations{new(policyv2.AutoGroupMember)},
+			Dst:    policyv2.SSHTestDestinations{usernamep(user1)},
 			Accept: []policyv2.SSHUser{policyv2.SSHUser("root")},
 		},
 	}