[TF-38853] Validate provider versions in config match the lock file

[arunatibm]

Description

Fixes issue TF-38853

For a Stack configuration, if there is a discrepancy between the provider version declared in the component configuration and the the version in the .terraform.lock.hcl, the Stack will execute deployment runs. This is a problem since we have a split between the preferred version and the locked version and leads to confusion and inconsistency.
What is desired is that when the configured version and locked version differ, an error diagnostic must be generated. This will allow the practitioner to inspect, decide and fix the provider versions and then recreate the lock before executing a deployment run.

To recreate this issue, edit the provider version in the configuration file but do not regenerate the lock file. Then create a stack with this configuration. The deployment run will complete successfully.

The bulk of the functional changes are in these files, and the remaining are to fix test inputs because the new validations will fail.

- internal/stacks/stackconfig/provider_requirements.go
- internal/stacks/stackruntime/internal/stackeval/provider_config.go
- internal/stacks/stackruntime/internal/stackeval/provider_expressions.go
- internal/stacks/stackruntime/internal/stackeval/stack_config.go
- internal/stacks/stackruntime/internal/stackeval/walk_static.go

Testing

Created a mismatch between the lock and the configuration and ran $ terraform stacks validate and we see the validation errors in the command response.

╷
│ Error: Provider version doesn't match the lockfile
│
│   on ./components.tfcomponent.hcl line 15:
│   15: provider "random" "this" {}
│
│ Provider "registry.terraform.io/hashicorp/random" is locked at version 3.5.1 in the dependency lockfile, but the configuration's version constraints (~> 3.6.0) do not allow that version. This usually means the version constraints were changed after the lockfile was generated. Please run `terraform stacks providers lock` to update the lockfile and run this operation again with an updated configuration.
╵
╷
│ Error: Provider version doesn't match the lockfile
│
│   on ./components.tfcomponent.hcl line 16:
│   16: provider "random" "random-app-cache" {}
│
│ Provider "registry.terraform.io/hashicorp/random" is locked at version 3.5.1 in the dependency lockfile, but the configuration's version constraints (~> 3.6.0) do not allow that version. This usually means the version constraints were changed after the lockfile was generated. Please run `terraform stacks providers lock` to update the lockfile and run this operation again with an updated configuration.
╵
╷
│ Error: Provider version doesn't match the lockfile
│
│   on ./components.tfcomponent.hcl line 17:
│   17: provider "random" "random-app-rev-proxy" {}
│
│ Provider "registry.terraform.io/hashicorp/random" is locked at version 3.5.1 in the dependency lockfile, but the configuration's version constraints (~> 3.6.0) do not allow that version. This usually means the version constraints were changed after the lockfile was generated. Please run `terraform stacks providers lock` to update the lockfile and run this operation again with an updated configuration.
╵
╷
│ Error: Provider version doesn't match the lockfile
│
│   on ./components.tfcomponent.hcl line 18:
│   18: provider "random" "random-app-payment" {}
│
│ Provider "registry.terraform.io/hashicorp/random" is locked at version 3.5.1 in the dependency lockfile, but the configuration's version constraints (~> 3.6.0) do not allow that version. This usually means the version constraints were changed after the lockfile was generated. Please run `terraform stacks providers lock` to update the lockfile and run this operation again with an updated configuration.
╵
Failure! Terraform Stacks configuration is not valid, please check and fix the errors printed above.

Snippet of the configuration with the provider declarations

required_providers {
  random = {
    source  = "hashicorp/random"
    version = "~> 3.6.0"
  }
}

provider "random" "this" {}
provider "random" "random-app-cache" {}
provider "random" "random-app-rev-proxy" {}
provider "random" "random-app-payment" {}

Snippet from the lock file

provider "registry.terraform.io/hashicorp/random" {
  version = "3.5.1"

Target Release

Next upcoming minor release

1.17.x

Rollback Plan

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

N/A

CHANGELOG entry

• This change is user-facing and I added a changelog entry.
• This change is not user-facing.

[NicoletaPopoviciu]

@tommyokeefe please assist w a review when core team has the capacity; thank you

[austinvalle]

Thanks for the PR @arunatibm 👋🏻 !

These changes are looking good, I just left some minor comments to consider 👍🏻

[arunatibm]

Addressed changes from the review.