Agent hostname serial number base64 encoding contains invalid DNS characters

[backkem]

The algorithm for computing the agent hostname (network.bs §Computing the Agent Hostname) encodes the certificate serial number as RFC 4648 base64, but standard base64 can produce +, /, and = characters which are invalid in DNS labels.

The spec correctly specifies that encodedInstanceName and encodedDomain should replace characters outside [A-Za-z0-9-] with hyphens, but no such encoding is specified for base64SerialNumber.

Suggested fix: Specify URL-safe base64 (RFC 4648 Section 5) without padding for the serial number encoding, which uses only [A-Za-z0-9_-].

Alternative fix: Also use the hyphen escaping here, but it seems less canonical for this purpose.