[Feature] terraform_plan: provider_name operation to check which provider manages each resource #420

Problem

There is no way to check which provider manages each resource in a Terraform plan. A common guardrail is "AWS, Google Cloud and Azure resources must use the official HashiCorp providers", which catches lookalikes such as registry.terraform.io/acme/aws or a private-registry fork. The plan already has this as resource_changes[*].provider_name, but no terraform_plan operation returns it:

• attribute only reads change.after.*.
• provider_config needs one exact terraform_provider_full_name and returns its version_constraint or region, not the name. It also misses resources that use a provider with no provider block.

Proposed solution

Add an operation_type: "provider_name" to the terraform_plan provider. It returns provider_name for every resource change that matches terraform_resource_type (* for all), honors exclude_resource_types like action and count, and reports severity 1 when no resource of the requested type is found.

{
  "meta": {"version": "v1", "required_provider": "stackguardian/terraform_plan"},
  "evaluators": [{
    "id": "official_cloud_providers",
    "provider_args": {"operation_type": "provider_name", "terraform_resource_type": "*"},
    "condition": {
      "type": "RegexMatch",
      "value": "^(registry\\.(terraform\\.io|opentofu\\.org)/hashicorp/(aws|google|google-beta|azurerm|azuread)|(?!.*/(aws|google|google-beta|azurerm|azuread)$).*)$"
    }
  }],
  "eval_expression": "official_cloud_providers"
}

Alternatives considered

• provider_config per provider: needs one evaluator per exact provider name and cannot apply a regex to the name.
• The json provider on the plan file: works for the CLI, but the plan-aware integrations route plans to terraform_plan.

Additional context

Released 1.2.1 and main both return a severity-99 "operation_type is not supported" error for this today.