build(deps): bump terraform to 1.15.8

[KazuyaMiyagi]

What are you trying to accomplish?

Bump the bundled Terraform version from 1.15.3 to 1.15.8.

The bundled version has been 1.15.3 since #15055 was merged on 2026-05-29, while the latest Terraform release is 1.15.8 (released 2026-07-08). Repositories whose required_version tracks the latest release cannot receive any provider updates, because terraform init fails before Dependabot evaluates the update — in directories where module resolution requires init:

Error: Unsupported Terraform Core version

  on main.tf line 2, in terraform:
   2:   required_version = "1.15.8"

This configuration does not support Terraform version 1.15.3. To proceed,
either choose another supported Terraform version or update this version
constraint. Version constraints are normally set for good reason, so updating
the constraint may lead to other errors or unexpected behavior.

This is the same failure mode reported in #15038 and fixed by #15055. It recurs on every Terraform release, since the updater runs a fixed Terraform version regardless of the repository's constraint (#5797).

Anything you want to highlight for special attention from reviewers?

Only terraform/Dockerfile changes — the three ARG lines. Both checksums were taken from the official SHA256SUMS for 1.15.8, using the exact commands documented in the comments above each ARG:

$ curl -s "https://releases.hashicorp.com/terraform/1.15.8/terraform_1.15.8_SHA256SUMS" | grep -E "linux_(amd64|arm64)\.zip$"
d25ce7b6902013ad905db3d2eab0be4cd905887fe88b81a6171b8d5503c31f3d  terraform_1.15.8_linux_amd64.zip
8891e9dcedc9e3b8950bc6af9d4d8af1f4cfade3062f53b9dc403a89f6ce8c9c  terraform_1.15.8_linux_arm64.zip

Unrelated to the change itself, but worth flagging: the supported-version table in github/docs is behind as well, and the two copies of it disagree with each other — content/code-security/reference/supply-chain-security/dependabot-options-reference.md says <= 1.10.x while data/reusables/dependabot/supported-package-managers.md says <= 1.13.x. Per CONTRIBUTING.md I've filed github/docs#45307 to bring both in line with the bundled version. It's a draft until this PR is merged and rolled out.

How will you know you've accomplished your goal?

The image build in CI exercises the download and the sha256sum -c verification, so a successful build confirms both the version and the checksums are correct.

Checklist

• I have run the complete test suite to ensure all tests and linters pass. — run in CI on this PR: all 56 checks are green, including ci (terraform), Lint and Sorbet
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality. — no new test applies to a pinned version, so this is covered by arm64-build (which exercises the download and the sha256sum -c verification) and by e2e (terraform, smoke-terraform.yaml), which runs an end-to-end Terraform update on an image built with 1.15.8. Both are green
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Pull request overview

Updates the bundled Terraform runtime to support repositories requiring Terraform 1.15.8.

Changes:

• Bumps Terraform from 1.15.3 to 1.15.8.
• Updates AMD64 and ARM64 checksums.