Only allow selected trusted Terraform providers in modules

[rswrz]

The Module CI workflows should verify the providers that will be installed and used before any installation or usage occurs. If this step fails due to an unknown or untrusted Terraform provider, the workflow should fail immediately, and terraform init should not be run at any point in the process.

Terraform provides a JSON output of the defined providers, which can be leveraged to identify unknown or untrusted providers.

Example output:

$ terraform -version -json
{
  "terraform_version": "1.9.0",
  "platform": "darwin_arm64",
  "provider_selections": {
    "registry.terraform.io/azure/azapi": "1.15.0",
    "registry.terraform.io/hashicorp/azurerm": "4.10.0",
    "registry.terraform.io/hashicorp/random": "3.6.3",
    "registry.terraform.io/hashicorp/tls": "4.0.6"
  },
  "terraform_outdated": true
}

It may also be helpful to allow certain namespaces, such as hashicorp and azure. Additionally, we should restrict providers to those from registry.terraform.io only.

[rswrz]

If we allow providers from the whole hashicorp namespace, we may explicitly deny some providers. E.g., the external provider.