fix(terraform): resolve module output edges by identity, not path alone

[pszypowicz]

Summary

• Fix _should_add_edge() to match output vertices by full module identity (get_vertex_as_tf_module()) instead of path only, preventing wrong edge connections when two module calls share the same source
• Add regression test that verifies variable resolution works correctly in this scenario

Details

When two module calls share the same source (e.g., modules "a" and "b" both using ./mod_a), and a third module "c" references one of their outputs, the old path-only check in _should_add_edge() could connect the edge to the wrong module instance. This corrupted variable resolution for module "c", leaving var.* references unresolved and causing false positives (e.g., CKV_AZURE_35).

The fix is a one-line change replacing the loose path comparison with get_vertex_as_tf_module(module_node), which already exists in the codebase and compares the full module identity (name, path, nested modules).

Fixes #7470

Test plan

• New test test_module_output_edge_with_same_source_siblings passes with the fix
• Same test fails without the fix ('Deny' != 'var.default_action')
• All existing graph builder tests pass (49/49)
• All variable rendering tests pass (205/205)

[pszypowicz]

Why this works:

The bug is in _should_add_edge() at local_graph.py:845. The method decides which output vertex to connect an edge to when resolving module.<name>.<output> references.

The old second condition:

self.get_abspath(vertex.source_module_object.path) == self.get_abspath(module_node.path)

Only compared file paths. When modules "a" and "b" both use source ./mod_a, their output vertices live at the same path — so the first match wins (alphabetically), connecting to the wrong module instance.

The fix:

vertex.source_module_object == get_vertex_as_tf_module(module_node)

get_vertex_as_tf_module() (already used elsewhere in this file, line 416) constructs a TFModule from the vertex, which includes the module name, path, and nested module chain. This distinguishes module "a" from module "b" even when they share the same source.