Add Terraform/OpenTofu state file scanning (--tfstate)

[bencehezso]

Summary

Adds --tfstate <path> to both subcommands, building an assessment from a local Terraform or OpenTofu state file instead of a live cloud account. No credentials, no API calls, nothing leaves the machine.

python3 main.py aws --tfstate infra.tfstate
python3 main.py azure --tfstate infra.tfstate

Also available via --config using providerDetails.tfstatePath.

What changes

• New core/utils_tfstate.py — parses state format v4 (rejecting v1–v3 with a message pointing at terraform state pull), flattens to one record per instance so count/for_each expansions are exact, maps Terraform types to services via tf_code, and aggregates into resource_inventory.
• Skipped stages — credential check, permission check and cost inventory print explicit skipped steps rather than being silently omitted. Risk assessment and report generation are unchanged, and reports render with an empty cost inventory.
• Location resolution — explicit region/location attribute first, then the region field of the resource's own arn. Referenced ARNs (stream_arn, kms_key_arn) are never used; they can point at another region or account.
• Provider mismatch — a state with nothing for the selected provider fails at the inventory stage with a message naming the other subcommand. A mixed state assesses only the selected provider and reports the excluded count.
• Scope of Assessment — the PDF now identifies the state file by name and SHA-256, with lineage and serial, plus regions (AWS) or subscription and resource group (Azure).

Security

State files hold generated passwords, connection strings and keys in plain text. Instance attributes are never copied anywhere: only address, type, location and count leave the state. In place of the raw API dump written by live assessments, tfstate mode writes raw_data/tfstate_manifest.json. Only the file's basename is recorded, and only the region field is taken from an ARN — the AWS account id is never extracted. Verified by grepping every report artifact against secret-like values harvested from the source states.