Add policy result types and diagnostic metadata plumbing

[dsa0x]

This is part of a stacked series to upstream the policy work in smaller, reviewable pieces:

• [Add policy client and protocol plumbing #38514]
• [Add policy result types and diagnostic metadata plumbing #38515] (this)
• [Wire policy evaluation into Terraform core runtime #38516]
• [Add CLI and backend policy wiring for plan apply and query #38518]
• [Add init-time policy evaluation #38519]

This PR adds the shared Terraform-side types needed to carry policy evaluation results through planning and execution, along with the diagnostic plumbing needed to preserve policy metadata and source context.

Included here

• plans.PolicyResults
• plan-side storage for policy results
• tfdiags support needed for policy diagnostics and metadata

Target Release

1.16.x

Rollback Plan

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

CHANGELOG entry

• This change is user-facing and I added a changelog entry.
• This change is not user-facing.