feat(microvm): add Terraform compute provider

[edersonbrilhante]

Description

Adds Terraform support for AWS Lambda MicroVM runner lanes on top of #5255, rebased onto the refreshed feat-microvm-runner-provider branch.

• adds compute_provider.aws.microvm with Terraform dispatch key aws_microvm while preserving runtime type microvm;
• adds the namespaced MicroVM provider and trust-policy modules under modules/compute-providers/aws/microvm;
• integrates MicroVM through runner-config, mixed-provider multi-runner maps, validation, outputs, and CI matrices;
• derives a lane-scoped MICROVM_METADATA_SSM_PATH under the persistent SSM configuration path for scale-up, scale-down, and pool;
• replaces unsupported runtime MicroVM tagging permissions with control-plane-only ssm:GetParametersByPath, ssm:PutParameter, and ssm:DeleteParameter access on that metadata prefix;
• scopes RunMicrovm and TerminateMicrovm to the configured image by default, with a validated explicit image allowlist for dynamic overrides;
• restricts iam:PassRole to the resolved execution role and iam:PassedToService=lambda.amazonaws.com;
• keeps the MicroVM execution role limited to lane-token SSM read/delete and scoped runtime log writes; externally supplied roles remain caller-owned;
• documents and tests global defaults, lane overrides, computed values, EC2/MicroVM isolation, metadata-path separation, and managed-versus-external role ownership.

modules/webhook/** is unchanged. EC2 implementation source is unchanged; only its provider overview documentation is updated to describe both selectable AWS providers.

Test Plan

• terraform -chdir=modules/compute-providers/aws/microvm test -no-color — 11 passed
• terraform -chdir=modules/compute-providers/aws/microvm/trust-policy test -no-color — 3 passed
• terraform -chdir=modules/runner-config test -no-color — 24 passed
• terraform -chdir=modules/multi-runner test -no-color — 46 passed
• terraform fmt -check modules/compute-providers/aws/microvm modules/runner-config modules/multi-runner
• targeted TFLint passed for the changed MicroVM provider, runner-config, and multi-runner files
• regenerated the affected Terraform module READMEs
• git diff --check and merge-conflict hook

The full recursive multi-runner TFLint invocation reproduced an existing no-output local hang. The same changed files passed a bounded non-recursive TFLint run; GitHub Actions remains authoritative for the full-module lint.

Related Issues

Depends on #5255. Related to #5252.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None