fix: use can(index()) to handle null proxy_client_password_auth_type (#85)

* fix: use can(index()) to handle null proxy_client_password_auth_type

Terraform's contains() throws "Invalid function argument" when the value
is null, even when guarded by an == null check, because both sides of ||
are evaluated. Replace with can(index()) which returns false for null or
non-matching values without erroring.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: upgrade stack-config to 2.0.0 to resolve cloudposse/utils provider conflict

stack-config v1.8.0 requires cloudposse/utils >= 1.7.1, < 2.0.0 while
account-map pulls in stack-config v2.0.0 which requires >= 2.0.0, < 3.0.0.
These constraints are mutually exclusive, causing terraform init to fail.

Upgrading all four remote-state module references to v2.0.0 aligns the
utils constraint to >= 2.0.0, < 3.0.0 across the full dependency tree.
The remote-state module interface is identical between v1.8.0 and v2.0.0.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: use GitHub source for iam_roles module to resolve CI init failures

Replace relative path reference to account-map with a pinned GitHub
source so terraform init succeeds without the CI-only account-map copy
workaround.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: RoseSecurity <72598486+RoseSecurity@users.noreply.github.com>

Author: 3 people

src/providers.tf

@@ -14,6 +14,6 @@ provider "aws" {
 }
 
 module "iam_roles" {
-  source  = "../account-map/modules/iam-roles"
+  source  = "github.com/cloudposse-terraform-components/aws-account-map//src/modules/iam-roles?ref=v1.537.2"
   context = module.this.context
 }

src/variables.tf

@@ -564,7 +564,7 @@ variable "proxy_client_password_auth_type" {
   description = "The type of authentication the proxy uses for connections from clients. Valid values: MYSQL_NATIVE_PASSWORD, POSTGRES_SCRAM_SHA_256, POSTGRES_MD5, SQL_SERVER_AUTHENTICATION"
 
   validation {
-    condition     = var.proxy_client_password_auth_type == null || contains(["MYSQL_NATIVE_PASSWORD", "POSTGRES_SCRAM_SHA_256", "POSTGRES_MD5", "SQL_SERVER_AUTHENTICATION"], var.proxy_client_password_auth_type)
+    condition     = var.proxy_client_password_auth_type == null || can(index(["MYSQL_NATIVE_PASSWORD", "POSTGRES_SCRAM_SHA_256", "POSTGRES_MD5", "SQL_SERVER_AUTHENTICATION"], var.proxy_client_password_auth_type))
     error_message = "Valid values for proxy_client_password_auth_type are: MYSQL_NATIVE_PASSWORD, POSTGRES_SCRAM_SHA_256, POSTGRES_MD5, SQL_SERVER_AUTHENTICATION."
   }
 }