fix: include referenced resources in resource block's __tfmeta (fixes #99)

[albertodonato]

• add a references entry in a resource's __tfmeta if attributes reference other resources, which lists referenced blocks and they IDs. This allows c7n-left to build cross references, allowing traversal filters to work properly
• report the actual values for attributes that reference other blocks rather then metadata. This allows value-based matches in policies for those attributes.

[kapilt]

we'll need some release notes about the breaking change as well

[kapilt]

lgtm, thanks

[ajkerrigan]

It looks like we won't be able to see references in a case like this:

resource "aws_instance" "example" {
  launch_template {
    id = aws_launch_template.example.id
  }
}

resource "aws_launch_template" "example" {
  name = "example"
  metadata_options {
    http_endpoint = "enabled"
    http_tokens = "required"
  }
}

Where the use case is using a traverse filter to see if an instance has IMDSv2 enforced via metadata_options.http_tokens == 'required' on its associated launch template.

For what it's worth, we don't catch this as a reference on main either. But I bring it up here because if the issue is that we're not seeing or tracking references that come from nested blocks inside resources, I don't know if that has any impact on how to approach this PR.