refactor(terraform): aws provider upgrade to v6 (#23)

# Description

This PR updates Terraform provider lock data to include AWS provider v6
and aligns template sync ignore behavior for addon-specific local files.

Compared to main, this branch:

- Upgrades locked `hashicorp/aws` provider version in
`.terraform.lock.hcl` from `5.100.0` to `6.42.0` (including checksum
updates).
- Normalizes the locked `hashicorp/helm` constraint in
`.terraform.lock.hcl` to `>= 3.0.0`.
- Adds `migrations.tf` and `.templatesyncignore.local` to
`.templatesyncignore`.
- Adds `.templatesyncignore.local` to prevent overriding addon-specific
templated files.
- Syncs `helm_keyring` description wording in `variables-addon.tf` and
generated `README.md`.

No issue is fixed by this PR.

## Type of change

- [ ] A bug fix (PR prefix `fix`)
- [ ] A new feature (PR prefix `feat`)
- [x] A code change that neither fixes a bug nor adds a feature (PR
prefix `refactor`)
- [ ] Adding missing tests or correcting existing tests (PR prefix
`test`)
- [ ] Changes that do not affect the meaning of the code like
white-spaces, formatting, missing semi-colons, etc. (PR prefix `style`)
- [ ] Changes to our CI configuration files and scripts (PR prefix `ci`)
- [ ] Documentation only changes (PR prefix `docs`)

## How Has This Been Tested?

- Plan and apply with the updated lock file to ensure no issues with
provider versions.

Author: katapultcloud

.github/workflows/template-sync.yaml

@@ -53,3 +53,6 @@ jobs:
 
       - name: Terraform Validate
         run: terraform validate
+
+      - name: Terraform Test
+        run: terraform test -verbose

.github/workflows/validate.yaml

@@ -7,5 +7,5 @@ README.md
 .secrets.baseline
 .github/workflows/renovate.yaml
 renovate.json
-addon-oidc.tf
-variables-addon-oidc.tf
+migrations.tf
+.templatesyncignore.local

.templatesyncignore

@@ -0,0 +1,2 @@
+addon-oidc.tf
+variables-addon-oidc.tf

.templatesyncignore.local

@@ -56,8 +56,8 @@ See [basic example](examples/basic) for further information.
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_addon"></a> [addon](#module\_addon) | git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon | v1.0.0-rc2 |
-| <a name="module_addon-irsa"></a> [addon-irsa](#module\_addon-irsa) | git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon-irsa | v1.0.0-rc2 |
+| <a name="module_addon"></a> [addon](#module\_addon) | git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon | v1.0.0 |
+| <a name="module_addon-irsa"></a> [addon-irsa](#module\_addon-irsa) | git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon-irsa | v1.0.0 |
 ## Resources
 
 | Name | Type |
@@ -113,7 +113,7 @@ See [basic example](examples/basic) for further information.
 | <a name="input_helm_disable_webhooks"></a> [helm\_disable\_webhooks](#input\_helm\_disable\_webhooks) | Prevent Helm chart hooks from running. Defaults to `false`. | `bool` |
 | <a name="input_helm_enabled"></a> [helm\_enabled](#input\_helm\_enabled) | Set to false to prevent installation of the module via Helm release. Defaults to `true`. | `bool` |
 | <a name="input_helm_force_update"></a> [helm\_force\_update](#input\_helm\_force\_update) | Force Helm resource update through delete/recreate if needed. Defaults to `false`. | `bool` |
-| <a name="input_helm_keyring"></a> [helm\_keyring](#input\_helm\_keyring) | Location of public keys used for verification. Used only if `helm_package_verify` is `true`. Used only when `helm_package_verify` is `true`. Defaults to `~/.gnupg/pubring.gpg`. | `string` |
+| <a name="input_helm_keyring"></a> [helm\_keyring](#input\_helm\_keyring) | Location of public keys used for verification. Used only when `helm_package_verify` is `true`. Defaults to `~/.gnupg/pubring.gpg`. | `string` |
 | <a name="input_helm_lint"></a> [helm\_lint](#input\_helm\_lint) | Run the Helm chart linter during the plan. Defaults to `false`. | `bool` |
 | <a name="input_helm_package_verify"></a> [helm\_package\_verify](#input\_helm\_package\_verify) | Verify the package before installing it. Helm uses a provenance file to verify the integrity of the chart; this must be hosted alongside the chart. Defaults to `false`. | `bool` |
 | <a name="input_helm_postrender"></a> [helm\_postrender](#input\_helm\_postrender) | Value block with a path to a binary file to run after Helm renders the manifest which can alter the manifest contents. Defaults to `null`. | <pre>object({<br/>    binary_path = string<br/>    args        = optional(list(string))<br/>  })</pre> |

.terraform.lock.hcl

@@ -2,7 +2,7 @@
 module "addon-irsa" {
   for_each = local.addon_irsa
 
-  source = "git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon-irsa?ref=v1.0.0-rc2"
+  source = "git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon-irsa?ref=v1.0.0"
 
   enabled = var.enabled
 

README.md

@@ -11,7 +11,7 @@ locals {
 }
 
 module "addon" {
-  source = "git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon?ref=v1.0.0-rc2"
+  source = "git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon?ref=v1.0.0"
 
   enabled = var.enabled
 

addon-irsa.tf

@@ -27,7 +27,7 @@ module "eks_cluster" {
   }
 
   name       = "eks"
-  region     = data.aws_region.this.name
+  region     = data.aws_region.this.id
   subnet_ids = module.vpc.public_subnets
 }
 

addon.tf

@@ -261,7 +261,7 @@ variable "helm_package_verify" {
 variable "helm_keyring" {
   type        = string
   default     = null
-  description = "Location of public keys used for verification. Used only if `helm_package_verify` is `true`. Used only when `helm_package_verify` is `true`. Defaults to `~/.gnupg/pubring.gpg`."
+  description = "Location of public keys used for verification. Used only when `helm_package_verify` is `true`. Defaults to `~/.gnupg/pubring.gpg`."
 }
 
 variable "helm_timeout" {