Add a validity check for HashiCorp Terraform API tokens

🤖 AI wrote this code from my instructions.

Unreviewed AI output often lands on reviewers and costs them time.
This MR is human verified: I read the full diff and ran the tests myself, because your time is as valuable as mine.

This merge request adds a validity check for HashiCorp Terraform user and organization API tokens.

Resolves #631848 (closed). Stacked on !260314 (merged), which lets the vendor definition use the real rule ID.

Gap

• GitLab detects Hashicorp Terraform user/org API token rule, but validity checks did not verify it.

Fix

• We generated HashicorpTerraformClient and its spec from a vendor definition using the generator.
• The check calls GET /api/v2/account/details on HCP Terraform, and is only enabled for GSS findings.
• Every mapping decision was measured against real tokens:
  • Live user and organization tokens return 200.
  • Revoked user and organization tokens return 401.
• The rule has no capture group, so the finding keeps the surrounding quotes.
• BaseClient now strips one pair of quotes before the request.

Notes

• HashiCorp reserves 401 for token problems.
  • A valid token without access gets 404, which stays unmapped and reads as unknown.
• Self-hosted Terraform Enterprise tokens share the same format.
  • We can only verify against HCP Terraform, so a live Terraform Enterprise token reads as inactive.

MR acceptance checklist

I have evaluated this MR against the MR acceptance checklist.