fix: re-evaluate submodules when inputs change

[fwereade]

Addresses the failing test from #186

Uses a forked defsec with changes as seen here

To summarize that diff:

• re-evaluates submodules when their inputs change
• fixes object merge bug already handled upstream

There's a small performance hit from re-evaluating the modules but it's reasonably good at not re-evaling when nothing's changed, and I'm pretty confident in the approach. (The hit could probably be reduced by diffing current-submodule-inputs against merged-previous-inputs-and-outputs, instead of against previous-inputs.)

If/when the upstream bug is fixed, we would still likely be better served updating our dependency to point at https://github.com/aquasecurity/trivy/tree/main/pkg/iac instead of https://github.com/aquasecurity/defsec/tree/v0.93.1/pkg

[ajkerrigan]

Thanks for working on this and sharing the discussion here 👍