Backport of [TF-38853] Validate provider versions in config match the lock file into v1.16

[github-actions]

Backport

This PR is auto-generated from #38829 to be assessed for backporting due to the inclusion of the label 1.16-backport.

The below text is copied from the body of the original PR.

---

Description

Fixes issue TF-38853

For a Stack configuration, if there is a discrepancy between the provider version declared in the component configuration and the the version in the .terraform.lock.hcl, the Stack will execute deployment runs. This is a problem since we have a split between the preferred version and the locked version and leads to confusion and inconsistency.
What is desired is that when the configured version and locked version differ, an error diagnostic must be generated. This will allow the practitioner to inspect, decide and fix the provider versions and then recreate the lock before executing a deployment run.

To recreate this issue, edit the provider version in the configuration file but do not regenerate the lock file. Then create a stack with this configuration. The deployment run will complete successfully.

The bulk of the functional changes are in these files, and the remaining are to fix test inputs because the new validations will fail.

- internal/stacks/stackconfig/provider_requirements.go
- internal/stacks/stackruntime/internal/stackeval/provider_config.go
- internal/stacks/stackruntime/internal/stackeval/provider_expressions.go
- internal/stacks/stackruntime/internal/stackeval/stack_config.go
- internal/stacks/stackruntime/internal/stackeval/walk_static.go

Testing

Created a mismatch between the lock and the configuration and ran $ terraform stacks validate and we see the validation errors in the command response.

╷
│ Error: Provider version doesn't match the lockfile
│
│   on ./components.tfcomponent.hcl line 15:
│   15: provider "random" "this" {}
│
│ Provider "registry.terraform.io/hashicorp/random" is locked at version 3.5.1 in the dependency lockfile, but the configuration's version constraints (~> 3.6.0) do not allow that version. This usually means the version constraints were changed after the lockfile was generated. Please run `terraform stacks providers lock` to update the lockfile and run this operation again with an updated configuration.
╵
╷
│ Error: Provider version doesn't match the lockfile
│
│   on ./components.tfcomponent.hcl line 16:
│   16: provider "random" "random-app-cache" {}
│
│ Provider "registry.terraform.io/hashicorp/random" is locked at version 3.5.1 in the dependency lockfile, but the configuration's version constraints (~> 3.6.0) do not allow that version. This usually means the version constraints were changed after the lockfile was generated. Please run `terraform stacks providers lock` to update the lockfile and run this operation again with an updated configuration.
╵
╷
│ Error: Provider version doesn't match the lockfile
│
│   on ./components.tfcomponent.hcl line 17:
│   17: provider "random" "random-app-rev-proxy" {}
│
│ Provider "registry.terraform.io/hashicorp/random" is locked at version 3.5.1 in the dependency lockfile, but the configuration's version constraints (~> 3.6.0) do not allow that version. This usually means the version constraints were changed after the lockfile was generated. Please run `terraform stacks providers lock` to update the lockfile and run this operation again with an updated configuration.
╵
╷
│ Error: Provider version doesn't match the lockfile
│
│   on ./components.tfcomponent.hcl line 18:
│   18: provider "random" "random-app-payment" {}
│
│ Provider "registry.terraform.io/hashicorp/random" is locked at version 3.5.1 in the dependency lockfile, but the configuration's version constraints (~> 3.6.0) do not allow that version. This usually means the version constraints were changed after the lockfile was generated. Please run `terraform stacks providers lock` to update the lockfile and run this operation again with an updated configuration.
╵
Failure! Terraform Stacks configuration is not valid, please check and fix the errors printed above.

Snippet of the configuration with the provider declarations

required_providers {
  random = {
    source  = "hashicorp/random"
    version = "~> 3.6.0"
  }
}

provider "random" "this" {}
provider "random" "random-app-cache" {}
provider "random" "random-app-rev-proxy" {}
provider "random" "random-app-payment" {}

Snippet from the lock file

provider "registry.terraform.io/hashicorp/random" {
  version = "3.5.1"

Target Release

Next upcoming minor release

1.17.x

Rollback Plan

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

N/A

CHANGELOG entry

• This change is user-facing and I added a changelog entry.
• This change is not user-facing.

---

Overview of commits

• 80b0875

• b9d1ffe

• 5dfbe08

• 3638b17

• b041bcb

• 77f4c56

• ae3a506

• 6539b7f

• 3c0d287

• 09a2fa3

• 81e27bd

• 9532585

• 6477d85

• d5f083d

• 7bc1bff

• 1afdd83

• 850f031

[austinvalle]

Looks like this backport PR needs to be fixed anyways (which I will do at some point), but we aren't planning on landing this change until v1.16.1

🛑

[austinvalle]

Marking this as ready to signify that the backport was completely successfully manually + verified by me (I just used the squashed commit from main)

This PR still should not be merged until v1.16.0 has been successfully released 🛑