fix(api_token): migrate permission_groups data source references instead of extracting map keys

[rotem-cloud]

Problem

The cloudflare_api_token migrator incorrectly handled permission_groups that referenced the cloudflare_api_token_permission_groups data source. Expressions like:

data.cloudflare_api_token_permission_groups.all.permissions["DNS Read"]

had the map key string ("DNS Read") extracted as the permission group ID, producing invalid output:

permission_groups = [{ id = "DNS Read" }]  # wrong — should be UUID

Additionally, the data source block was silently removed via a Preprocess regex with no warning.

Fix

1. Bracket-depth tracking in transformPermissionGroups

Replaced the boolean inList flag with an integer bracketDepth counter. TokenQuotedLit tokens are only collected at depth 1 (direct list elements), not at depth 2+ (index access keys like ["DNS Read"]).

2. Data source reference → for-expression conversion

When expression elements are detected, each is parsed to check if it matches data.cloudflare_api_token_permission_groups.<label>.<category>["<name>"]. If so, it's converted to a for-expression against the v5 replacement data source:

permission_groups = [{
  id = [for pg in data.cloudflare_api_token_permission_groups_list.all.result : pg.id if pg.name == "DNS Read"][0]
}]

3. Datasource migrator (new)

Added internal/datasources/api_token_permission_groups/v4_to_v5.go that renames the data source block from cloudflare_api_token_permission_groups to cloudflare_api_token_permission_groups_list instead of silently removing it.

4. Fallback for unrecognized expressions

Expressions that don't match the data source pattern are wrapped as { id = <expr> } with a diagnostic warning.

Testing

• All 12 unit tests pass (including 2 new test cases for the bug scenario)
• Integration tests pass
• Full suite: 94 packages, 0 failures
• E2E verified against real Cloudflare infrastructure:
  • v4 config with data source refs → tf-migrate → v5 config with for-expressions
  • terraform apply with v5 provider succeeds
  • terraform plan shows no drift

Files changed

File	Change
internal/resources/api_token/v4_to_v5.go	Core fix + for-expression generation
internal/datasources/api_token_permission_groups/v4_to_v5.go	New datasource migrator
internal/registry/registry.go	Register new migrator
internal/resources/api_token/v4_to_v5_test.go	Fix + add test cases
integration/.../api_token/expected/api_token.tf	Updated expected output

Closes #298