Disallow creating CDNS zones for sandbox TLDs

Do not allow the user to create TLDs on sandbox that aren't of the form
"*.test.".  If real TLDs are created, they will block users from registering
names under that TLD for the nameserver set that we're using for sandbox.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=209983482

java/google/registry/tools/CreateCdnsTld.java

@@ -63,6 +63,14 @@ class CreateCdnsTld extends ConfirmingCommand {
 
   @Override
   protected void init() {
+    // Sandbox talks to production Cloud DNS.  As a result, we can't configure any domains with a
+    // suffix that might be used by customers on the same nameserver set.  Limit the user to setting
+    // up *.test TLDs.
+    if (RegistryToolEnvironment.get() == RegistryToolEnvironment.SANDBOX
+        && !dnsName.endsWith(".test.")) {
+      throw new IllegalArgumentException("Sandbox TLDs must be of the form \"*.test.\"");
+    }
+
     managedZone =
         new ManagedZone()
             .setDescription(description)

javatests/google/registry/tools/CreateCdnsTldTest.java

@@ -15,6 +15,7 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.testing.JUnitBackports.assertThrows;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
@@ -77,4 +78,13 @@ public class CreateCdnsTldTest extends CommandTestCase<CreateCdnsTld> {
     ManagedZone zone = requestBody.getValue();
     assertThat(zone).isEqualTo(createZone("cloud-dns-registry-test", "test run", "tld.", "tld."));
   }
+
+  @Test
+  public void testSandboxTldRestrictions() throws Exception {
+    IllegalArgumentException thrown =
+        assertThrows(
+            IllegalArgumentException.class,
+            () -> runCommandInEnvironment(RegistryToolEnvironment.SANDBOX, "--dns_name=foobar."));
+    assertThat(thrown).hasMessageThat().contains("Sandbox TLDs must be of the form \"*.test.\"");
+  }
 }