fix(query): handle list-form access_logs in ELBv2 LB Access Log Disabled

[arpitjain099]

Description

The Terraform query aws/elb_v2_lb_access_log_disabled (ELBv2 LB Access Log Disabled) reports a false positive when access_logs is written as a list of objects rather than a single nested block.

The query read resource.access_logs.enabled directly, assuming access_logs is always parsed as an object. When the config uses the list form:

resource "aws_lb" "test" {
  name = "test-lb-tf"

  access_logs = [{
    bucket  = aws_s3_bucket.lb_logs.id
    enabled = true
  }]
}

the parser stores access_logs as an array, so resource.access_logs.enabled is undefined. The second CxPolicy block (not valid_key(resource.access_logs, "enabled")) then fires and the load balancer is flagged as having access logging disabled even though enabled = true.

Fix

Normalize access_logs to a list of blocks before the enabled check, mirroring the object-or-array handling already used by other queries (for example aws/efs_volume_with_disabled_transit_encryption). The enabled check then works for both the single-block and list shapes, and the search key / search line are indexed only in the list case so the single-block results are unchanged.

True positives are preserved: access_logs absent, enabled missing, or enabled not set to true are still reported, including when access_logs is a list.

Tests

• test/negative3.tf: list-form access_logs with enabled = true (the reported false positive) - must not be flagged.
• test/positive7.tf: list-form access_logs with enabled = false - must still be flagged.
• test/positive_expected_result.json updated for positive7.tf.

Verified locally:

• go test ./test/ -run 'TestQueries$/terraform/aws/elb_v2_lb_access_log_disabled' passes.
• TestQueriesContent and TestQueriesMetadata for the query pass.
• Reverting only query.rego while keeping the new fixtures makes the test fail (the original query flags negative3.tf and reports positive7.tf on the wrong line), confirming the fix is what resolves the false positive.

Closes #8036