PSS: Add parsing of .tfmigrate.hcl files to define state migration operations

[SarahFrench]

Closes https://hashicorp.atlassian.net/browse/TF-36919

This PR enables parsing .tfmigrate.hcl files and new blocks:

• state_store_provider (like required_providers but enforces a single provider and the constraint has to be a specific value)
• migrate_from_state_store (like a state_store block)
• migrate_from_backend (like a backend block)

This PR also implements validation in the parser like:

• No duplicate blocks allowed - and enforcing this across 1+ files.
• The migrate_from_state_store and migrate_from_backend blocks are mutually exclusive.
  • Similarly, migrate_from_backend and state_store_provider are mutually exclusive.
• If using migrate_from_state_store, state_store_provider must also be present.
• Providers described in migrate_from_state_store and state_store_provider must match.
• A state_store_provider block may only describe a single version (pin to a version, no range of versions) of a single provider (only one entry).

The state migrate command will eventually use this logic, and this PR hasn't connected those parts of the codebase yet. When that does happen I expect that calling code would populate the ProviderSupplyMode data.

Target Release

1.16.x

Rollback Plan

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

CHANGELOG entry

• This change is user-facing and I added a changelog entry.
• This change is not user-facing.

[SarahFrench]

Some self-review/contextual comments to help others with review.

[SarahFrench]

This serves a similar purpose as this code in NewModule:

terraform/internal/configs/module.go

Lines 193 to 195 in badc70c

	if mod.StateStore != nil {
	diags = append(diags, mod.resolveStateStoreProviderType()...)
	}

[SarahFrench]

The logic in this method was adapted from the decodeRequiredProvidersBlock function:

terraform/internal/configs/provider_requirements.go

Lines 33 to 48 in badc70c

	func decodeRequiredProvidersBlock(block *hcl.Block) (*RequiredProviders, hcl.Diagnostics) {
	attrs, diags := block.Body.JustAttributes()
	if diags.HasErrors() {
	return nil, diags
	}
	ret := &RequiredProviders{
	RequiredProviders: make(map[string]*RequiredProvider),
	DeclRange: block.DefRange,
	}
	for name, attr := range attrs {
	rp := &RequiredProvider{
	Name: name,
	DeclRange: attr.Expr.Range(),
	}

In decodeStateStoreProviderBlock we don't have multiple attributes (i.e don't have multiple local names with paired objects). We return early if there isn't 1 entry. After that there's no need for looping but the code looks very similar to that original code.

[SarahFrench]

Also, I figured it was worth reusing existing types instead of creating a new type that used Version instead of VersionConstraint, so this method returns a RequiredProvider pointer.

Due to this we still use a version constraint, but I opted for validation that asserts the constraint is pinning to an exact value. The hashicorp/go-version representation of the version constraint doesn't allow calling code to inspect data and ask 'is this constraint using an = operator (implied or explicit)?'. Because of that, I landed on this approach where I check for an = operator (implied or explicit) and then attempt to parse the string as a version, and use successful parsing as a sign that the constraint was pinning a single version.

If there are other/better approaches to this I'm keen to get feedback. An alternative is updating hashicorp/go-version but I think that decision shouldn't be taken lightly.