fix(kraft): match controller listener by exact name, not string prefix

[amuraru]

Split out of #300 (2/6).

configureBrokerKRaftMode identified the controller listener among the
"listeners" entries with listener[:len(controllerListenerName)] == strings.ToUpper(controllerListenerName). This slice-prefix comparison has
three failure modes, none guarded by validation:

• Panic (slice out of range) when controllerListenerName is longer than a
  listener entry string (long controller name + short-named listener).
• False match when one listener name is a prefix of another
  (e.g. "CONTROLLER" vs "CONTROLLER-EXTERNAL"): a broker-only node would
  silently drop the CONTROLLER-EXTERNAL listener.
• When no controller listener is defined (controllerListenerName == ""),
  the empty prefix matched every entry, so broker-only nodes were assigned
  an empty listeners= (a broker listening nowhere).

Replaces it with isControllerListenerEntry, which compares the listener
NAME segment (before "://") exactly and treats an empty
controllerListenerName as "no match". For every valid KRaft config (an
internal listener marked usedForControllerCommunication, distinct
listener names) the output is unchanged.

The two golden strings that changed belong to an intentionally invalid
KRaft topology in TestGenerateBrokerConfigKRaftModeSSL (the "controller"
listener is declared as an external listener, so no controller listener is
identified). Their previous values encoded the buggy empty-prefix behavior.