support for credential scan

[teowa]

armstrong credscan [-v] [-working-dir <path to Terraform configuration files>] [-swagger <path/dir to the swagger files>]

credscan command will scan .tf files under the target working directory, and build index based on given swagger repo if provided or download online index file if not provided, then match properties set in azapi_resource in .tf files and the corrsponding x-ms-secret marked properties in swagger, fire error if these credential fields set in azapi_resource:

1. does not refer to a variable
2. the refered variable is not found
3. the refered variable has a default value
4. the refered variable does not set sensitive: true

And the errors is saved in json/markdown format, specifically armstrong_credscan_{date}/error.json and armstrong_credscan_{data}/error.md under the working directory.

example

[
  {
    "file_name": "/home/xxx/projects/go/armstrong/hcl/testdata/test.tf",
    "resource_name": "azapi_resource.virtualMachine",
    "resource_type": "Microsoft.Compute/virtualMachines@2023-03-01",
    "property_name": "#.properties.osProfile.adminPassword",
    "error_message": "must use variable for secret field",
    "line_number": 108
  },
  {
    "file_name": "/home/xxx/projects/go/armstrong/hcl/testdata/test.tf",
    "resource_name": "azapi_resource.virtualMachine2",
    "resource_type": "Microsoft.Compute/virtualMachines@2023-03-01",
    "property_name": "#.properties.osProfile.adminPassword",
    "error_message": "variable \"password\" used in secret field but has a default value, please remove the default value",
    "line_number": 156
  },
  {
    "file_name": "/home/xxx/projects/go/armstrong/hcl/testdata/test.tf",
    "resource_name": "azapi_resource.virtualMachine2",
    "resource_type": "Microsoft.Compute/virtualMachines@2023-03-01",
    "property_name": "#.properties.osProfile.adminPassword",
    "error_message": "variable \"password\" used in secret field but is not marked as sensitive, please add \"sensitive: true\" for the variable",
    "line_number": 156
  }
]

current limitations:

1. To match azapi_resource and swagger model, we mock resource ID based on azapi_resource.type, and then use mocked resource ID to find the swagger model. The resource ID is simply mocked by adding subscription and resource group prefix and then add customized resource names, e.g., Microsoft.Network/virtualNetworks to subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/xxx. So in some cases the mocked resource ID is not correct, e.g., Microsoft.Resources/resourceGroups. But this might be OK for we only cares about credential field, and most of these resource should be under resource group level.

2. Only simple variable usage can be processed. Other terraform grammer like module, for_each, dynamic block or etc is not supported.

[ms-henglu]

Thank you so much for making this PR! LGTM