feat(terraform): support optional() type constraints in variable rendering

[pszypowicz]

Summary

Resolves #4874

When a Terraform variable uses optional(type, default) in its type constraint and the caller omits that field, checkov does not resolve the default value. This causes false-positive/false-negative check results -- for example, optional(string, "RSA-HSM") for a Key Vault key type is not resolved, so CKV_AZURE_112 (KeyBackedByHSM) incorrectly fails.

Changes

• New optional_type_parser module that parses optional() defaults from type constraint strings, with recursive descent into nested objects at arbitrary depth (map/list/set/object at every level)
• Renderer integration at all three variable resolution points (MODULE edge, TF_VARIABLE edge, extract_value_from_vertex)
• Fix each.value.a.b.c multi-level path resolution in the for_each handler -- the old code only took split('.')[-1], breaking nested object access. The fix reuses the existing find_in_dict utility. Also handles array indexing (each.value.items[0].field) and multiple references in one expression (merge(each.value.tags, {Name = each.value.name}))

Test plan

• Unit tests for the parser: default value types (string, number, bool, null, float, map, list), edge cases (empty string, negative numbers, colons in values), nested types with mutation safety
• Graph-level tests: for_each expansion, direct variable reference, 3-level nested object resolution
• End-to-end CKV_AZURE_112 regression test with 4 scenarios: list(object) PASS/FAIL + map(object) nested PASS/FAIL
• Full terraform test suite: 2873 passed, 0 regressions