Exclude expression context from marked for_each diagnostics

[wata727]

Fixes #2243
See also hashicorp/hcl#737

The hcl.DiagnosticTextWriter has an issue where it will panic when writing out a diagnostic that has an expression containing a marked value.

TFLint can run into this issue when expanding the for_each meta-argument with a sensitive value. If the for_each is not iterable (it is not iterable if marked), a diagnostic containing the expression context of the for_each is created and written to stderr by the DiagnosticTextWriter.

Hopefully this will be fixed in upstream, but here's a workaround to prevent the panic by excluding expression context from the diagnostic when the for_each is marked.

By the way, other cases that include expression context in diagnostics do not have the same issue, so no action is required.

• for_each is marked in dynamic blocks
  • The value is always unmarked, and non-iterable cases are rarer than those in meta-arguments

  • tflint/terraform/tfhcl/expand_spec.go

    Lines 48 to 49 in 0fd691f

    	// For dynamic blocks only, it allows marked values
    	unmarkedEachVal, _ := eachVal.Unmark()

• dynamic block labels

  • tflint/terraform/tfhcl/expand_spec.go

    Line 200 in 0fd691f

    if labelVal.IsMarked() {

  • Dynamic block labels are rarely used in Terraform
    • Can't use known variables in dynamic block labels hashicorp/terraform#32180
• count in meta-arguments
  • The value is always unmarked

  • tflint/terraform/tfhcl/expand_spec.go

    Line 265 in 0fd691f

    countVal, _ = countVal.Unmark()